Virus Database

Joshi.a

Description Joshi.a

These are dangerous stealth viruses. They infect floppy disks Boot-sectors and hard disk MBR during an access to them (INT 13h, ah=2,3,4,0Ah,0Bh). The viruses include two parts - the first part contains the body of the virus and is placed onto the boot sector (or MBR) of the disk, the second part contains the original first sector of the infected disk and the other eight sectors of the virus, and occupies the 40th or 80th track of the floppy disk (the virus uses nonstandard format); on the hard disks the second part of the virus body begins from the second sector of the starting track. The viruses can destroy FAT when they save their own copy on the disk.
The viruses hook INT 21h. Just after starting (rebooting of the system) they permanently check the interrupt vector 21h, and if it is changed the viruses read the new value of the vector. The viruses hook INT 9h (keyboard). When the ALT-CTRL-DEL keys are used to boot the system, the viruses will emulate rebooting: clear the screen and so on. The viruses will stay resident even if you boot the system from a clean and write-protected floppy disk.
On the 5th of January the viruses will display the message "Type `Happy Birthday, Joshi'!" and will wait for the entering "Happy Birthday, Joshi!" from the keyboard. The viruses hook the INT 8, 9, 13h, 21h.

Check other viruses! Be aware! Use Antiviral Software

Quandary

Description Quandary

It is a harmless memory resident stealth boot virus. The code of the virus is partly encrypted. The virus hooks INT 13h and writes itself to the MBR of the hard drive and boot sectors of the 1.44M floppy disks. The virus checks the disks for some program (boot driver? some other boot virus?), and infects these disks without alteration of the original boot sectors.

Quark.1600

Description Quark.1600

It is not a dangerous memory resident parasitic virus. It hooks INT 15h, 21h and writes itself to the end of COM and EXE files that are executed. By hooking INT 15h the virus intercepts keyboard on old-style (PC-286) computers and changes keyboard data. The virus contains the text strings:
smothered to inertness by bendelosangeles Arg~AdeN

If this string is changed, the virus deletes the host file.

Home