Virus Database

Aref.670

Description Aref.670

This is a memory resident parasitic virus. It hooks INT 21h and writes itself to the end of files that are executed. It infects COM files only.
It has an EXE infection routine, but this routine is never executed, and is partly erased by the encrypted text:
-= PERSIAN GULF =-
Hey you! Jump to the FIRE!
This is a VIRUS, By:Aref Karimi (Wizard) The Last days of 1375.
Be happy, he he
It also hooks INT 17h and 33h and disables the mouse and printing. On the 6th of any month, this virus erases the CMOS, decrypts and displays the following message:
"Aref V.2.0" sends the greetings and
deep regards to U. he is looking for
someone to talk to, please contact to
the following EMAIL address :
Aref@REMOVED.CMOS.DATA !
Sig: Aref.K.1998 ;)

Check other viruses! Be aware! Use Antiviral Software

ExeBug.a

Description ExeBug.a

This is a family of boot and multipartite stealth viruses. They hook INT 13h and write themselves to the MBR of the hard drive and boot sectors of the floppy disks. Multipartite viruses of that family overwrite the headers of EXE file with a virus dropper. Other viruses overwrite the EXE files with trojan programs that erase the hard drive sectors when infected files are executed.
It uses a program trick to load itself into the memory after cold reboot and loading from clean system floppy (that trick works under limited types of BIOSes, see also "Ugly" virus). The virus disables the floppy drives by erasing corresponding areas in the CMOS, and enables the floppy drives after loading from infected hard drive. As a result the loading procedure goes in that way: the BIOS checks the floppy disk and does not find them, then checks the hard drive and detects it, and then loads the system from the hard drive that is already infected. The virus receives the control, enables the floppy drives, and passes the control to the floppy boot sector.

ExeBug.d

Description ExeBug.d

This is a family of boot and multipartite stealth viruses. They hook INT 13h and write themselves to the MBR of the hard drive and boot sectors of the floppy disks. Multipartite viruses of that family overwrite the headers of EXE file with a virus dropper. Other viruses overwrite the EXE files with trojan programs that erase the hard drive sectors when infected files are executed.
It occupies two sectors and hooks INT 1Ch, but there is only the first virus sector in my collection, and it is not enough for complete analysis.

Home