Virus Database

Mini.60.a

Description Mini.60.a

These are extremely primitive non memory resident harmless viruses. They write themselves to all .COM files of the current directory. The peculiarity of these viruses is their small length. All infectors contain the string "*.COM" or "*.com".
The length of files getting infection by "Mini.127.b" virus grows for 127+n bytes, where 'n' is the number of virus generation.
"Mini.132" contains the text "Foxy".
"Mini.200" contains the text "Tony".
"Mini.207" infects the files that have a block of 207 zero bytes. The virus inserts into this "zero" block, the length if the file does not grow.
"Mini.233" on Friday, 13th decrypts and displays the string:
VirX 3/90

Check other viruses! Be aware! Use Antiviral Software

Bog.233.a

Description Bog.233.a

It's a harmless not memory resident parasitic virus. It searches for Windows EXE-files and infects DOS-part of them. It does it by quite interesting method. It uses the fact, that a lot of Windows EXE-files have a DOS part of code. That code is executed if the Windows EXE is started under DOS. Usually these DOS parts of code have the same format in different Windows EXE-files. These parts contain the warning message like "This program requires Microsoft Windows." and several assembler instructions that display this message and return the control to DOS. Usually these instructions are:
MOV AH,9
INT 21h ; display the message
MOV AX,4C01h
INT 21h ; return to DOS

This virus reads the first 80h bytes of the DOS executable code (below the EXE header) and checks it for "WIN" or "Win" string. If that string is found, the virus starts to search for the assembler instructions listed above. If that code is present, the virus writes into the file 233 bytes of own code from last INT 21h instruction:
MOV AH,9
INT 21h ; display the message
MOV AX,4C01h
CALL $+3 ; virus code starts here

On execution from MS-Windows infected files works as usually, on execution from DOS it displays standard Windows' warning message and then the virus starts to work.
The also virus contains the internal text string:
BOG (C) '93 by GROG - Italy

Boing.349

Description Boing.349

It is a harmless nonmemory resident encrypted parasitic virus. It search for .COM files and writes itself to the end of the file. It contains the string:
[BOING]

Home