Virus Database

8ball.a

Description 8ball.a

It is not a dangerous memory resident multipartite virus. While executing an infected file the virus copies itself into HMA, hooks INT 40h, and then overwrites boot sectors of the floppy disks. While loading from an infected disk the virus hooks INT 1Ah, waits for DOS loading, and hooks INT 21h. On first call to INT 21h the virus creates on C: drive the file with a random selected name, and writes the virus copy to that file. Then the virus adds the string:
INSTALL=C:
to the end of the C:CONFIG.SYS file. As a result while loading from infected C: drive the virus receives the control in the infected file. After infection the virus restores INT 21h (removes itself from the memory).
The virus uses anti-debugging tricks, performs some commands with keyboard ports, contains the text strings:
PK
INSTALL=C:c:config.sys
8_Ball -=Q=-

Check other viruses! Be aware! Use Antiviral Software

LittBrother Family

Description LittBrother Family

There are harmless memory resident companion viruses. They copy themselves into the DOS data area and hook INT 21h. When an .EXE file is executing, these viruses create the COM files with the same name but .COM extension.
Several of these viruses contain the text: "Little Brother".
On November, 3rd some of the viruses display the messages:
"LittBrother.349": DID YOU VOTE, SHITHEAD??
"LittBrother.385": Elvis is dead!Virus: Elvis is Dead
Author: Dead Elvis [FLooD]

On January, 1st "LittBrother.393,398" display:
"LittBrother.393,395": Ein gutes neues Jahr !
"LittBrother.398": Working on New year ???

LittleBoy.944

Description LittleBoy.944

It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. Depending on its counter the virus displays the message in Russian. It also contains the string:
)by Little Boy.1995.V0.3(SIMPLE

Home