Virus Database

Kreg.1405

Description Kreg.1405

It is a harmless memory resident parasitic polymorphic virus. It hooks INT 10h, 21h and writes itself to the end of COM and EXE files that are executed or renamed. The virus does not infects the files: *CA?.*, *AN?.*, *ES?.*, *WE?.*, *IN?.* (SCAN, COMMAND, AIDSTEST, WEB, ADINF).
While installing the virus uses a trick that hides the virus on the memory map: the virus copies its INT 21h handler (49 bytes) to BIOS data area at address 0000:04D0, sets INT 21h to there and hooks INT 10h. When any program calls DOS function (INT 21h), the virus compares it with Execute and Rename functions (4Bh, 56h) and calls INT 10h with AX=DEADh. This is an "infect-it" call, and virus INT 10h handler intercepts it and infects a file.
The virus contains the text strings:
[ Gremlin 1.04 / AVL ]
[ KREG 1.01 / AVL !

Check other viruses! Be aware! Use Antiviral Software

Fbd.1000

Description Fbd.1000

It is a very dangerous nonmemory resident encrypted parasitic virus. It searches for .COM files, then writes itself to the end of the file. The virus has a bug, and while infecting it may corrupts the files. On 2nd of any month depending on the system time the virus displays one of the messages listed below and then reboots or halts the computer, or exits to DOS:
Non-System disk or disk error
Replace and strike any key when ready
Insert diskette for drive C: and strike
any key when ready
Program too big to fit in memory
Cannot load COMMAND, system halted

FCL.2044

Description FCL.2044

This is a dangerous memory resident encrypted parasitic virus. It hooks INT 21h, and writes itself to the end of COM and EXE files that are accessed. The virus does not infect files with names HW*, V3*, etc. according to the string (two bytes per name):
HWV3F-J2T2TKTVTBWCCODEVIFIGIRAFEMTBRWI

On December 25, or if the system date is December 3rd 1997, or depending on some system conditions (if some memory resident anti-virus is installed?) the virus erases the CMOS.
The virus contains the text strings:
[FCL virus ] Nice Meet You See Again
NO WORK LAW

Home