Virus Database

Atas Family

Description Atas Family

These are non memory resident (except "Atas.1268") harmless viruses. One part of viruses body is encrypted. After getting start the viruses infect COM-files of current directory. When virus hits a file the message like "OK." or "I like to travelall" can appear on the screen. The viruses contain texts: "*.COM" and
"Atas.384": ATAS(Kiev) V3.03 Cr.91.10.11
"Atas.400": ATAS V0.1 Cr.24.01.92
"Atas.1268": ATAS Corporation.(C)Copyright (B)BadWare

"Atas.1268" is the memory resident virus. If the key PrintScreen is pressed then this virus "falls" all the letters on the screen. It also hooks INT 5, 21h.
Atas.3215,3233,3321
These are not dangerous memory resident encrypted stealth viruses. They hook INT 8, 10h, 16h, 1Ch, 21h and write themselves at the end of COM-files are accessed. These viruses contain the text strings:
bye
music
letters
isplay
Bye-Bye.
ATAS Corporation.(B)1992 ,V1 Created in the Kiev by ATAS.

These infectors check the keyboard input and compare the text entered with a words 'bye', 'music', 'letters', 'isplay'. They manifest themselves in case of word: 'music' - they play the tune; 'letters' - they 'drop' the screen letters; 'isplay' - they change the cursor position; 'bye' - they type 'Bye-Bye.' and remove the virus TSR part from the memory.

Check other viruses! Be aware! Use Antiviral Software

Rash.1737

Description Rash.1737

It is a harmless memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed or closed. When infected files are opened, the virus disinfects them. The virus does not manifest itself in any way, it contains the text string:
- Rash97 -

Rasputin

Description Rasputin

It is not a dangerous memory resident stealth boot virus. It is encrypted in sectors and well as in the system memory. It hooks INT 13h and writes itself to the MBR of the hard drive and the boot sector of the floppy disks. Location on a disk is in free clusters which virus marks as BAD (pseudo-bad clusters).
While loading at 4am the virus decrypts and runs a video-effect and displays the text:
RASPUTIN
Coded By
Blue Skull

Home