Virus Database

MSN-Worm.Jitux

Description MSN-Worm.Jitux
Jitux is an Internet worm that spreads via the MSN Messenger system. It is written in Visual Basic and its' size is about 24KB.
The worm sends messages with the URL of the downloadable version of the worm.
Once the worm is launched, it scans the victim MSN Messenger contact list and sends all contacts the following message:
http://www.home.no/[censored]/jituxramon.exe
Jitux repeats this process over set intervals (about 1 minute).

Check other viruses! Be aware! Use Antiviral Software

Ninja.1225

Description Ninja.1225

These are very dangerous memory resident parasitic viruses. They hook INT 21h and infect COM and EXE files except COMMAND.COM and AIDSTEST.EXE. Before and after infecting a file the viruses write to the end of the file blocks of random data of random length (from 0 till 255 bytes), the result looks as follows:
+------+------+---------+---+
|File |XXXXXX|Virus |XXX|
+------+------+---------+---+

Sometimes the viruses overwrite the files with a small program that decrypts and displays the message:
"Ninja.1336":
DZINA VIRUS v 4.0 Copyright (C) 1990,91,97 Dzina Corp

"Ninja.1370,1376":
Mutant Ninja Version 2.0 Copyright (C) 1990,91 Virus&Worm Software

In 1992 on 13th of any month the viruses erase the FAT of C: drive. They also contain the texts:
COMMAND.COM AIDSTEST.EXE .COM .EXE

Ninja.Craz
It fails to detect itself in already infected files, and affects them two and more times. Depending on the system date and time it plays a tune, corrupts the files, erases the disk sectors and reboots the computer. It contains the text:
Mutant VIRUS Copyright (C) 1996,97 Craz Software

Ninja.Raving
These are harmless viruses. These viruses infect the same EXE file two and more times. "Raving.1195" contains the text:
It's a beautiful life!
Can't stop raving

Ninja.Raving.1181

Description Ninja.Raving.1181

These are harmless memory resident parasitic viruses. They hook INT 21h and write themselves to the end of COM and EXE files (except COMMAND.COM and AIDSTEST.EXE) that are accessed. Before and after infecting a file the viruses write to the end of the file the data of random selected length (from 0 till 255 bytes). The viruses infect the same EXE file two and more times. The viruses contain the text strings:
COMMAND.COM AIDSTEST.EXE .COM .EXE

"Raving_II.1195" also contains:
It's a beautiful life!
Can't stop raving

Home