Virus Database

Karina.850

Description Karina.850

It is not a dangerous nonmemory resident parasitic virus. It searches for COM files, then writes itself to the end of the file. On September 23th it displays the text:
_____ _____ _____ ______ ______ ______ _____ __ __ ___ __
__ __ __ __ __ __ __ __ __ __ __ ____ __
_____ ___ ___ _____ __ ______ __ _____ __ __ __ __ __
__ __ __ __ __ __ __ __ __ __ __ ____
______ _____ ______ ______ __ ______ ______ _____ __ ___

The virus also contains the string:
KarinaB

Check other viruses! Be aware! Use Antiviral Software

Antiwin_II, family

Description Antiwin_II, family

These are dangerous memory resident parasitic encrypted viruses. They trace INT 21h, hook INT 9, 21h, 2Fh and write themselves to the end of .EXE files that are executed. The viruses check the file names and do not infect several anti-virus and utilities according to the following string (four bytes per name):
DRWEAIDSMSCAANTIAVP WEB SCANMSAVVSAFGUARADINKRNLDOSXWSWADSWAWIN3

The viruses use on-the-fly encryption/decryption by hooking INT 1 (tracing), so their code is encrypted in the memory as well as in the files. The viruses have bugs and in some cases halt the computer while infecting files.
In some cases the viruses change the symbols that are entered (INT 9). On Windows initialization call INT 2Fh AX=1605h the viruses depending on the system time display the message and halt the computer:
Use registered copies of MS Windows

The viruses also contain the text:
Greetings from MrStrange, Kiev T.G.Shevchenko University
>Antiwin<, (c) by MrStrange.

The master copy of these viruses also contain the text:
MrStrange hails you from Kiev! My first virus

AntiWin_III.1342

Description AntiWin_III.1342

This is a dangerous nonmemory resident parasitic virus. It searches for COM files in a current and parent directories, then writes itself to the end of the file. If a file WIN*.COM is found, the virus overwrites it with a program that displays the message and returns to DOS:
This program requires Microsoft Windows
The virus displays messages in Russian on December 2nd, waits for 'Y/N' answer and may format hard drive sectors. This virus also contains/displays messages in English:
This computer is virus protected
Hi ! I'm AntiWindows v.2.0 !
->AntiWindows<- (C)1997 by Alexey C.
C:autoexec.bat
C:DOSirthday.com

Home