Leech.1024
Description Leech.1024
These are memory resident encrypted viruses. They hook INT 21h and write themselves into COM files that are executed or closed. If the first instruction of the file is a JMP (E9h or EBh), then the virus inserts itself into the file middle at the address to where JMP instruction points, else the virus writes itself to the beginning of the file. While infecting the virus uses undocumented System File Table.
Depending on the current time "Leech.1024", "Glist.1014" and "Tazta.1008" display the messages and erase the sectors of the root directory of the current drive:
"Leech.1024": The leech liveall
"Leech.Tazta.1008": Super, Super! ... March 1993, Tazta.
"Leech.Glist.1014": Mr.Tapeworm May 1996 The GLIST
"Leech.Warrier.768" is a harmless virus. It contains the text:
The WARRIER!
Check other viruses! Be aware! Use Antiviral Software
BanBan
Description BanBan
It is not a dangerous memory resident boot stealth virus. It hooks INT 13h and writes itself to the boot sectors of floppy disks and to the MBR of the hard drive. In several cases it decrypts and displays the message:
[ ÆÑ ÆÑ Ró$ 9222500088]
Bandersnatch
Description Bandersnatch
Bandersnatch is a not dangerous memory resident stealth polymorphic parasitic virus. It traces and hooks INT 21h, and writes itself at the end of COM- and EXE-files are accessed. Its polymorphic routine slows down the computer very much. Sometimes it calls the trigger routine that slowly puts the screen out. It contains the internal text string in Russian and:
DOS-UP
What's fuck?
|