Virus Database

IRC-Worm.Readme.1077

Description IRC-Worm.Readme.1077

This is an IRC worm spreading through IRC channels and using the mIRC client for spreading. The worm appears on a computer as the README.EXE DOS program. When this file is executed by a user, the virus installs itself resident into DOS memory and infects DOS COM files (except COMMAND.COM) that are executed. The virus is encrypted in infected files, and its code is placed at the end of files.
The virus also creates its "dropper" README.EXE on the C: drive (this file has a "hidden" attribute) and "registers" it in the C:AUTOEXEC.BAT in the very first lines: they contain an instruction to execute virus the dropper upon each rebooting.
To spread through mIRC channels, the virus searches for the C:INTERNETMIRCdirectory and creates a SCRIPT.INI file there that contains just one command for sending the README.EXE dropper to anybody joining the infected channel.
The worm contains the following text strings:
;-)x
whose name means dark matter vir-L

Check other viruses! Be aware! Use Antiviral Software

Areopag.480

Description Areopag.480

It is a not dangerous memory resident parasitic virus. It hooks INT 21h and writes itself at the end of COM-files that are executed. Depending on the system timer, it disables ChangeDir function. It contains the internal text strings:
* Equus Trojanus v1.1 (C) AREOPAG No.15 *

Argentina.1249

Description Argentina.1249

This is a memory resident not dangerous virus which hooks INT 21h and writes itself into the beginning of .COM-files (except COMMAND.COM) when they are started. During infection the virus creates the file MOM.MOM, writes itself into this file, appends a file getting infection to MOM.MOM, deletes the file and renames the MOM.MOM to the file name. If the COMMAND.COM is started the virus checks the current date and on May, 25th, on June, 20th, on July, 9th, on August, 17th the virus types one of the messages:
25 de Mayo Declaración de la independencia Argentina
20 de Junio Dia de la bandera Argentina
9 de Julio Dia de la independencia Argentina
17 de Agosto Aniversario de la defunción del Gral. San Martin

Then virus types:
Argentina Virus escrito por AfA - Virus benigno - ENET 35
Pulse una tecla para continuarall

This virus also contains the texts: "Argentina Virus 1.00", "COMMANDCOM", ":MOM.MOM".

Home