Aragorn.1522
Description Aragorn.1522
This is a relatively harmless, non-memory resident parasitic virus that searches for .COM and .EXE files, writing itself to their ends. It contains the internal text "(C)1992 Aragorn-Rome". On October 28th, it decrypts and types:
MUSSOLINI
DUX
28 OTTOBRE
ANNIVERSARIO
MARCIA SU ROMA
BOIA CHI MOLLA
Check other viruses! Be aware! Use Antiviral Software
BAT.Batalia2
Description BAT.Batalia2
This is the harmless non-memory resident BAT infector. It searchs for BAT files in the current directory, then writes itself to the end of the file. While infecting it creates temporary files and write necessary data to them.
The virus contains the following text:
BATalia2
BAT.Batalia3
Description BAT.Batalia3
This is the harmless non-memory resident parasitic BAT virus. It searches for BAT files in the current directory, then infectes them. While infecting a file the virus run the ARJ archiver to pack necessary files. If there is no ARJ.EXE file in PATH, the virus fails to replicate itself.
The virus contains two parts of code and data. The first part (the header) contains DOS commands:
@echo off
rem YYY
arj x %0 -g""bÑpß >nul
ren p Int
call i
ren Int a.bat
echo on
@call a
@echo off
del i.bat
del a.bat
del BATalia3
The second part (the rest) is an ARJ archive. This archive contains the I.BAT file that is the main virus code and the additional files:
P, BATALIA3
The BATALIA3 file contains several additional batch commands. The P file contains original code of an infected BAT file.
Thus any infected file contains the text strings (DOS commands) and the binary data (ARJ archive).
When executed, the virus runs the ARJ archiver, extracts the I.BAT and runs it. This batch file then searches for not infected BAT files in the current directory and infects them.
While infecting, the virus saves an original BAT file to ARJ archive (file P) and overwrites it. As a result the length of a file infected by BAT.Batalia3 may be less than before infection.
|