Oksana.1740
Description Oksana.1740
This is a very dangerous nonmemory resident parasitic encrypted virus. The virus searches for COM files then writes itself to the end of the file. The virus do not infects the COMMAND.COM file, but the string comparing utility has a bug, and the virus do not infect C*.COM files. If the virus detects a file that has COM extension and EXE internal format, the virus overwrites that file with a program that displays the message in Russian. Some viruses of that family disinfect the host file before return.
On October 21 the viruses display the message:
HAPPY BIRTHDAY OKSANA
Depending on the generation or counters the virus reads into the system memory and then erases the FAT of the C: drive and displays the message in Russian. Then the virus wait for 3:00am and restores the FAT.
It displays:
CRAZY ! I~m here !
Check other viruses! Be aware! Use Antiviral Software
Chemist.265
Description Chemist.265
It's harmless memory resident parasitic virus. It copies itself into Interrupt Vectors Table, hooks INT 21h and on DOS calls SetDir, SetDist, GetDiskSize it searches for .COM-files and writes itself at their ends. It contains the internal text strings:
*.com
Chemù7t
Cherry.2266
Description Cherry.2266
It is a dangerous memory resident encrypted parasitic virus. Being executed it cuts the block of system memory, copies itself to there, hooks INT 8 (timer) and returns the control to the host program. Some time after the virus hooks INT 21h and starts to infect the files that are opened or are accessed by FindFirst DOS function (that function is also called while executing a file). The virus writes itself to the end of .COM and .EXE files. The virus has a bug and in some cases halts the system.
Depending on its counter the virus manifests itself by some video effect (that code is corrupted in my sample of the virus), displays the messages:
Enter your name :all.
_____ ____________ _--STEALTH MUTANT-- Best< >
_¦ _________+__+____¦Arkhangelsk'95
_____+______¦__¦ __++ÇâÆô/¥ÅÅ/IV
---+-+-+--+-+ -+ -+ Hi
[Note: contains high ASCII chars that cannot be properly displayed with HTML]
|