Virus Database

Lilo.1573

Description Lilo.1573

This is a relatively harmless memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of COM and EXE files that are executed. On the 13th of any month, the virus, depending on the system time, displays messages (see below), and either returns to DOS or reboots the computer.
The virus also contains the following texts:
LI_LO.1573 virus v.0 (test) by P&C
COMMAND.COM.EXE

The messages are:
Divide error
Program too big to fit in memory
+------------------------------------------------------------------+
| If you want to be more SEXY, you must drink a lot of Pepsi ! |
| |
| XXXX XXXX |
| XXXX XXXX --+-- +-- |
| XXXX XXXX | +--+ +- |
| XXXX XXXX | | | +-- |
| XXXXXXX XXXX | |
| XXXXXXX XXXX |
| +--+ +-- +-- -+-- |
| Greetings to +--+ +- +-+ | |
| Marek Sell +--+ +-- --+ | |
| and |
| everybody, who can XXXX XXXXX |
| read this text XXXX XXXX XXXX |
| XXXX XXXX XXXX |
| from PiCSof XXXXXXXX XXXX XXXX |
| XXXXXXXX XX XXXXX XX |
| |
| |
+-------------------------------------------------COPYRIGHT 1996---+

Check other viruses! Be aware! Use Antiviral Software

Bog.233.a

Description Bog.233.a

It's a harmless not memory resident parasitic virus. It searches for Windows EXE-files and infects DOS-part of them. It does it by quite interesting method. It uses the fact, that a lot of Windows EXE-files have a DOS part of code. That code is executed if the Windows EXE is started under DOS. Usually these DOS parts of code have the same format in different Windows EXE-files. These parts contain the warning message like "This program requires Microsoft Windows." and several assembler instructions that display this message and return the control to DOS. Usually these instructions are:
MOV AH,9
INT 21h ; display the message
MOV AX,4C01h
INT 21h ; return to DOS

This virus reads the first 80h bytes of the DOS executable code (below the EXE header) and checks it for "WIN" or "Win" string. If that string is found, the virus starts to search for the assembler instructions listed above. If that code is present, the virus writes into the file 233 bytes of own code from last INT 21h instruction:
MOV AH,9
INT 21h ; display the message
MOV AX,4C01h
CALL $+3 ; virus code starts here

On execution from MS-Windows infected files works as usually, on execution from DOS it displays standard Windows' warning message and then the virus starts to work.
The also virus contains the internal text string:
BOG (C) '93 by GROG - Italy

Boing.349

Description Boing.349

It is a harmless nonmemory resident encrypted parasitic virus. It search for .COM files and writes itself to the end of the file. It contains the string:
[BOING]

Home