Virus Database

Multiani

Description Multiani

This is a dangerous memory resident boot virus. It hooks INT 13h and writes itself to boot sectors of the floppy disks and to the first boot sector of the hard drive. While infecting a sector, the virus patches the code of the standard boot routine in the boot sector. The virus writes, to the beginning of that routine, the JMP instruction, and writes the virus loader (37h bytes) to the area of the system error messages at the offset 01A4h. Then the virus writes its main code to the last sector of the root directory.
While loading from such a sector, the standard boot routine is interrupted by the patched code; the virus loader receives the control, reads the main virus code, hooks INT 13h, and returns control to the standard boot routine.
This way of infection corrupts the code of the not-MS-DOS boot sectors, and the system halts while loading from the infected disk.
In December the virus displays the following message:
La multi ani !

The virus also contains the following text strings, the second string is encrypted:
SoSo3
! ina itlum aL

Check other viruses! Be aware! Use Antiviral Software

MQ.278

Description MQ.278

It is not a dangerous memory resident parasitic virus. It copies itself into Interrupt Vectors Table, hooks INT 21h and writes itself to the beginning of .COM files that are created. After 13th infection the virus terminates the execution of the files and displays:
Fuck off

The virus also contains the ID-strings:
MQ
MW2

MR.962

Description MR.962

It is a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of .COM and .EXE files that are executed or opened. The virus has the bugs and can halt the system. On 17th of any month it deletes the files. The virus contains the text strings:
(c) MR7666
T910D

Home