Virus Database

Mirror.4130

Description Mirror.4130

It is a harmless memory resident parasitic stealth polymorphic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are accessed. It contains the text strings:
[ Mirror: Bit Addict / TridenT ]
COMSPEC=

The virus uses very unusual way of infection. It realizes the "anti-stealth" technique, that virus is "reverse" one. While accessing to not infected files with any DOS command they appears as infected, but the virus does not infect them on disk. The virus substitutes the original body and length of not infected files with their infected form. While viewing by any editor these files are visible as containing the virus code, but these files are not infected in real. DIR command reports increased file lengths. The way to infect the files is to copy them to not COM/EXE extensions, or pack with any packer such as ZIP or ARJ.

Check other viruses! Be aware! Use Antiviral Software

HH.1024.b

Description HH.1024.b

This is a very dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed or opened. On 11th of every month it erases the hard disk sectors. It contains the text string "HH" that is used as ID-word to identify already infected files.

Hi Family

Description Hi Family

These are memory resident parasitic viruses. Upon being executed, they decrease the DOS memory size (word at address 0000:0413), and install themselves into the memory by correcting the MCB blocks. Then they hook INT 21h, and write themselves to the end of EXE files that are executed. "Hi.378" infects COM files only.
The viruses contain the following text strings:
"Hi.460,512": Hi
"Hi.549": ACE OF BASE
"Hi.671": ACE OF BASE 2
"Hi.802": AOB 3

"Hi.378, 460," and "512" are harmless viruses, and do not manifest themselves in any way.
"Hi.549" hooks INT 17h, and disables printing. On October 31st, it corrupts CMOS memory and deletes files that are executed.
"Hi.671" hooks INT 17h, and changes the symbols that are printed: 'V' -> 'D', and 'b' -> 'j'. On October 31st, it deletes files that are executed. On August 29th, it disables INT 14h (COM ports).
On August 30th, "Hi.680" erases the disk sector, and "Hi.764" halts a computer. These viruses display the following messages:
"Hi.680":
Ha!Ha!!Ha!!!
You Have The Raveica Virus V1.3!

"Hi.764":
Ha!Ha!!Ha!!!
Ai un virus!
Pt. obtinerea devirusorului grabiti-va sa-l felicitati
astazi pe Claudiu Raveica cu ocazia zilei de nastere
Adresa:Str:Marasesti Bl:11 App:15
Oras:Bacau Jud:Bacau Cod:5500
Bing cu bang

"Hi.802" sometimes hooks INT 14h and 17h, and disables printers and COM ports.
"Hi.892": starting from October 24th, this virus hooks INT 08h and displays the following message:
NU MAI MISCA MOUSE-ul!
CA "A LOVESTI PESTE
COAIE

"Hi.895": starting from October 2nd, it hooks INT 08h (timer) and sometimes plays a tune.

Home