Virus Database

LR.2884

Description LR.2884

These are dangerous memory resident parasitic polymorphic viruses. While executing an infected program the viruses search for .COM and .EXE files and write themselves to the end of the file. Then they hook INT 15h, 1Ch, 21h and infect COM and EXE files that are executed. The viruses delete the CHKLIST.MS, CHKLIST.CPS, ANTI-VIR.DAT, SMARTCHK.CPS files.
In some cases the viruses display the message:
"LR.2884": LR1#nnnnn
"LR.3720": LR2#nnnnn

where 'nnnnn' is the virus generation. Depending on the system date and time the viruses manifest themselves with some video effect, display the messages. The viruses contain the text strings:
CHKLIST.MS CHKLIST.CPS ANTI-VIR.DAT SMARTCHK.CPS

and:
"LR.2884":
I love you, I'll kill you,
but I love you for ever.
(-) Enigma.
all bum, bum, bum (...) bang, bang ...
It's nice to be important
but it's more important to be nice. (..?)
Uprzejmie prosimy pana Sella
o ponowne umieszczenie opisów wirusów
wæwnåtrz programu 'MkS'.
Hello! I'm LastReplicator1 virus.

"LR.3720":
Uwazam, ze MKS_VIR nie sprawdza sie
MIEKKIE NARKOTYKI NIE SA CHYBA SZKODLIWE
DALSZE ZYCIE NIE MA SENSU
BAWMY SIE !
JESTEM NICZYM
ENIGMA
PHARAO
HAZA
LAST REPLICATOR
SCIENTISTS LIE
ONI MI ZAZDROSZCZA
If you believe in light
It's because of obscurity
If you believe in enjoy
It's because of sadeness
And if you believe in God
That's because of the Devil
(-) Enigma
BluLniercy
Nie wiedzå, co czyniå
Zapomnieli, e i ich czeka Pmierì
Z ræki Antychrysta
Wirus Vico-1000 zwiæksza rok pliku o 100
(co jest chyba oczywiste), a nie o 200.
Hello! I'm LastReplicator2 virus.

Check other viruses! Be aware! Use Antiviral Software

Joker01

Description Joker01

It is not a dangerous memory resident parasitic virus. It traces INT 21h, then hooks INT 9, 1Ch and 21h and writes itself to the end of COM and EXE files, while infecting EXE files the virus converts them to COM format. At the end of the infected files there is the text string:
JOKER-01

This virus is a combination of different viruses: "Cascade" - infecting the system memory, "VACSINA" - infecting EXE files, "Yankee" - handling INT 21h, and of the program-joke "FACE.COM" that is the origin of the virus' video-effects. As a result, this virus has fairly large size - about 30 Kb.
When any file is infected, the virus sets INT 9 (keyboard) and starts its internal counter. The counter decrements its value by 1 on every keystroke. When that counter reaches zero, a funny face appears on the screen.

Joker3.1084

Description Joker3.1084

It is a dangerous memory resident parasitic virus. When executed it copies itself into the system memory, and does not fix MCB list, that might cause system confusion. Then it hooks INT 21h and on several DOS calls it searches for .COM files of the current directory and writes itself to the end of the file. Depending on the system timer the virus decrypts and displays one of the messages:
You have the Joker ]I[ virus by Crypt Keeper [Joker 3]
Please insert tractor-feed toilet paper into printer
Impotence error causing erection at port adress 3E2 IRQ 5
This program requires Microsoft Windows.
Computer hungry : Insert 5-1/4 inch HAMBURGER in drive A:
Missing Light Magenta/Olive ribbon in printer.
Not enough memory.
Packed file corrupt.
Bad command or file name
Bad or missing command interpreter.

Home