Virus Database

Arianna.3426

Description Arianna.3426

This is a memory resident multipartite, encrypted and stealth virus. While executing an infected file it infects the MBR of the hard drive. While loading from infected MBR it hooks INT 1Ch, waits for DOS loading, then hooks INT 13h for stealth algorithm while accessing to infected MBR, and INT 21h to infects the files. It writes itself to the end of EXE files that are accessed. When an infected file is opened, the virus disinfects it.
Sometimes the viruses manifest themselves with a video effect and erase the original MBR sector (not first hard drive sector, but the sector containing the original MBR that was saved while infecting a disk). The viruses contain the text strings:
Coded in BARI ThanX to DOS UNDOCUMENTED
Check the code to discover the virus name
It is very easy ! Bye !!

Check other viruses! Be aware! Use Antiviral Software

Shame.1455

Description Shame.1455

It is a dangerous nonmemory resident encrypted parasitic virus. It searches for EXE files and writes itself to the end of the file. It deletes the TBSCAN.EXE, ANTI-VIR.DAT, CHKLIST.MS, CHKLIST.CPS, IVB.NTZ files. In some cases it erases the disk sectors and reboots the computer. The virus displays the messages:
Shame on you!
Where did I come from?
Dedicated to the people of Chung-Li, Tiawan.
I feel safe, don't you?
Dope!
Tiwanese rise to the top while looking down at the empty bottomall
Wait for the departure of you life...
God loves you!
Ur virux protexion sux.
It's a Shame.

Shanghai.848

Description Shanghai.848

It is a dangerous memory resident parasitic virus. It hooks INT 21h and intercepts the DOS functions 36h, 3Bh. On these calls the virus searches for .COM files and writes itself to the end of the file. On December, 20th it displays the message:
ShangHai Railway Institute
[high ASCII chars, not properly displayable]

and erases the hard drive sectors. It also contains the text string:
*.COM

Home