Virus Database

Markiz.2620

Description Markiz.2620

This is a dangerous memory resident encrypted parasitic virus. It traces and hooks INT 21h, then it infects COM and EXE files. The virus contains the text strings:
[-DEDiCA+ED-Ï0-MARKiZ-]
This virus writes itself to the beginning of COM files and to the end of EXE files that are accessed with DOS functions FindFirst/Next ASCII (AH=4Eh,4Fh). These functions are performed by DOS while executing a file from the command line, and the virus infects that file at that moment. The virus checks the file name before infecting, and does not infect the file if there are any of the following strings found at the beginning of a file name:
ADIN AID ANT DRW FIND MSA NAV VSA WEB

With a probability of 1/256 while executing the FO?MA*.EX* files (FORMAT.EXE), the virus renames them to *.?d? ('d' - 229 ASCII).
In February and October, some time after installation, the virus displays messages, and manifests itself with video and sound effects.

Check other viruses! Be aware! Use Antiviral Software

Abola.2420

Description Abola.2420

This is a very dangerous memory resident parasitic virus. It writes itself to the end of EXE and to the beginning of COM files that are terminated (on INT 22h call). The virus stays memory resident only if the XMS driver is installed. While copying its resident code, the virus patches the XMS driver, hooks INT 2Fh and leaves its code in Upper Memory.
The virus utilizes a rather unusual way of accessing the files - during INT 2Fh calls, the virus scans memory blocks and patches INT 22h (Terminate) address in programs' PSP. When these programs are terminated, the virus will infect them.
On Tuesdays, the virus overwrites the disk sectors with the string:
AbolaAbolaAbolaAbolaAbola

Abraxas.1170

Description Abraxas.1170

These are not memory resident dangerous viruses. They search for the first .EXE-files of current and parent directories and overwrite the files are found. They also create and overwrite C:DOSDOSSHELL.COM file. On execution they sound by internal speaker and display the picture:
##########################################################################
# #
# ###### ####### ####### ###### ### ### ###### ###### #
# ### ### ### ### ### ### ### ### ###### ### ### ### #
# ######## ####### ####### ######## #### ######## ###### #
# ### ### ### ### ### ### ### ### ###### ### ### ### #
# ### ### ####### ### ### ### ### ### ### ### ### ####### #
##########################################################################
They contain the internal text strings also:
*.exe c:dosdosshell.com .. MS-DOS (c)1992 ->>ABRAXAS-5<<--
allFor he is not of this day
...Nor he of this mind

Home