Virus Database

Liquid.1016

Description Liquid.1016

This is a very dangerous memory resident encrypted parasitic virus. It hooks INT 21h, and writes itself to the end of COM files that are executed. On March 30th, June 6th, December 24th and 30th the virus displays the following text and overwrites the disk sectors with the same text:
Liquid Power¸ Is A Dark Wizard 1996 Production
Helooooall.
I'm Very Very Sorry About Your HardDrive,
But Was It Really Worth Existing.?.
Soooo... Now It's Gone....(HAHAHAHAHA!!!)
Oh, I almost Forgot... The HardDrive Is Allready Fucked Up
Sooo Don't Try To Reboot....
Greets To All Virii Makers!
Liquid Power¸ 1996 Dark Wizard (Long Live Sweden)

Check other viruses! Be aware! Use Antiviral Software

Egg.833

Description Egg.833

These are memory resident harmless parasitic viruses. They hook INT 21h and infect .COM- and .EXE-files on accessing them. They hook INT 6Ch also and use that vector as "I'm here" function when they install the TSR copy. They contain the internal text string also:
"Egg.833": egg
"Egg.1000": [EGG]-1000 xxxxxxxyyyyyyyzzzzzzz eat cry sleep pizza cash
getbackjack'chickens are good.ribbitribbitmefrogufrogwefrogs

EICAR-Test-File

Description EICAR-Test-File
EICAR is a short 68-byte COM file that is detected by anti-virus programs as a virus, but is actually NOT "VIRAL" at all. When executed it just displays a message and returns control to the host program.
Why is this harmless file detected as a virus? The file was created in order to demonstrate to users the messages and procedures that anti-virus programs display when a real virus is detected.
Some time ago researchers from several anti-virus companies were asked by users to develop a way to demonstrate what would happen in case of a real virus attack; a sort of simulation of which messages anti-virus programs will display and what actions will be recommended to perform, e.t.c.
After some time and thought toward how to best satisfy the request, the anti-virus researchers decided to release some virus-simulators that would be some harmless file that does nothing but display a message(s) and then exits to DOS (host OS). It was decided that this file could contain only ASCII characters so that users could type it or copy it from a User Guide. As a result the COM file looks as follows:
X5O!P%@AP[4PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Despite having only ASCII characters, this COM file is nonetheless a legitime computer program that does work under DOS or in a DOS window under Windows, OS/2 or any other OS that is able to run DOS programs. When run or executed this COM-file simply displays a text message and exits to DOS. The displayed message looks as follows:
EICAR-STANDARD-ANTIVIRUS-TEST-FILE!

It is as simple as that, though a lot of anti-virus programs detect it as a virus named EICAR-Test-File or something close to this.
Kaspersky Anti-Virus software detects this file only if the file name EICAR.AVC is listed in the AVP.SET file. At user request, the EICAR.AVC file has been removed from the main Kaspersky Anti-Virus database.

Home