Virus Database

Obora.1558

Description Obora.1558

This is a dangerous memory resident parasitic virus. It hooks INT 21h, and stays memory resident. Upon executing each 3rd file, the virus searches for EXE files in the current directory, and writes itself to the end of the file.
On Sundays, the virus, depending on the system time, also hooks INT 8 (timer), and scrolls the screen on each 185th timer tick. On the 22nd of any month, the virus corrupts the CMOS and displays the following message:
** MY NAME IS TROUBLe ** HELLO FROM " KETY " - CREATED BY KEVIN

The virus also contains the text strings:
KETY - POLAND!!
PROSZE TU NIE GRZEBaC
96.02.12
TROUBLe - (c) by Kevin
OBORa 96 V1.0 (c) by KEVIN

Check other viruses! Be aware! Use Antiviral Software

Procuror

Description Procuror

It's a dangerous memory resident stealth boot virus. It hooks INT 8, 13h, 17h and writes itself into the MBR of hard drives and floppy boot sectors. It erases CMOS memory, formats the disk sectors, changes the digits that are printed, changes the keys that are entered from the keyboard. It contains the internal text string:
PROCUROR

Proh.1454

Description Proh.1454

This is a dangerous memory resident encrypted parasitic virus. It hooks INT 21h, and writes itself to the end of COM and EXE files that are accessed. It doesn't infect anti-virus programs with names beginning with:
AV, DR, TB, F-, FI, NO, SC (AVP, DRWEB, TBYTE, F-PROT, etc.)

When the virus installs itself into the memory, it also looks for the Windows directory and infects the file WIN.COM there.
Periodically, the virus deletes the following anti-virus data files:
ANTI-VIR.DAT, CHKLIST.MS, CHKLIST.CPS, AVP.CRC.

On the 27th of September, the virus displays the following message and waits for a keystroke:
PROH!] virus, written and (c) by Black Jack, 1999

The virus also disables the TSR anti-virus guards, VSAFE and TBDRVXXX.

Home