Virus Database

M.534

Description M.534

It is a dangerous memory resident parasitic virus. It does work only under old DOS versions (DOS 3.30 and other), but does not check the DOS version. When an infected file is executed, the virus hooks INT 21h and then writes itself to the end of EXE files that are opened.
The virus corrupts the files with the length greater than 64K. In some cases the virus also corrupts the EXE header fields. While infecting a file the virus patches the INT 24h handler and does not restores it after infection. When infecting a file the virus also displays the 'M' letter to the left top corner on the screen.

Check other viruses! Be aware! Use Antiviral Software

Nines.705

Description Nines.705

There are not dangerous memory resident encrypted parasitic viruses. They hook INT 17h, 21h and write themselves to the end of COM files that are executed. Sometimes they change the digits that are printed.
"Nines.776" is a very dangerous virus, it encrypts the files that are saved on disk.

Ninja.1225

Description Ninja.1225

These are very dangerous memory resident parasitic viruses. They hook INT 21h and infect COM and EXE files except COMMAND.COM and AIDSTEST.EXE. Before and after infecting a file the viruses write to the end of the file blocks of random data of random length (from 0 till 255 bytes), the result looks as follows:
+------+------+---------+---+
|File |XXXXXX|Virus |XXX|
+------+------+---------+---+

Sometimes the viruses overwrite the files with a small program that decrypts and displays the message:
"Ninja.1336":
DZINA VIRUS v 4.0 Copyright (C) 1990,91,97 Dzina Corp

"Ninja.1370,1376":
Mutant Ninja Version 2.0 Copyright (C) 1990,91 Virus&Worm Software

In 1992 on 13th of any month the viruses erase the FAT of C: drive. They also contain the texts:
COMMAND.COM AIDSTEST.EXE .COM .EXE

Ninja.Craz
It fails to detect itself in already infected files, and affects them two and more times. Depending on the system date and time it plays a tune, corrupts the files, erases the disk sectors and reboots the computer. It contains the text:
Mutant VIRUS Copyright (C) 1996,97 Craz Software

Ninja.Raving
These are harmless viruses. These viruses infect the same EXE file two and more times. "Raving.1195" contains the text:
It's a beautiful life!
Can't stop raving

Home