Virus Database

No444.474

Description No444.474

It is a harmless dangerous memory resident parasitic virus. It hooks INT 21h, 2Fh and writes itself to the end of .COM files that are executed. The virus contains a code that erases the MBR of the hard drive, but this code is never executed. The virus contains the text:
* SCHOOL No.444,MOSCOW *

Check other viruses! Be aware! Use Antiviral Software

Noiembrie.610

Description Noiembrie.610

This is a relatively harmless, non-memory resident encrypted parasitic virus. It searches for .COM files, then writes itself to the end of the file. It displays the following messages and returns to DOS:
On November 9th: 9 Noiembrie 1979 - Ziua Lui Cosmin
NoNov - HCA Romania September 1996
On Sundays: Sunday error 262 at 7053:0122

Noki.448

Description Noki.448

This is a very dangerous, memory resident parasitic virus. While executing, the virus copies its code into the video memory at the address BD00:0000, and saves its code on the hard drive to sector 17 (17/0/0 - sector/track/head). Then the virus copies its INT 21h handler code (39 bytes) into Interrupt Vectors Table, hooks INT 21h, and returns control to the host file.
The virus intercepts the file execution (AX=4B00h), reads its code from hard drive sector 17 to the video memory, and jumps to there. The infection routine gains control, and infects EXE files that have the 448-bytes "cave" of zero bytes. The virus overwrites that cave, and returns from an infection routine. Thus, the file length does not grow during infection.
On the 17th of odd months (January, March,all), the virus corrupts the MBR of the hard drive. The virus contains the following text string:
NOKI

Home