OnFire.1679
Description OnFire.1679
It is not a dangerous memory resident parasitic polymorphic virus. It hooks INT 21h and on DOS calls ChangeDir and CloseFile searches for COM files in the current directory and writes itself to the end of the file. On DOS calls OpenFile and RenameFile the virus disinfects the infected files.
Under debugger the virus displays the message:
This city is on fire tonightall
Recognize me
Check other viruses! Be aware! Use Antiviral Software
Champaigne family
Description Champaigne family
These are very dangerous nonmemory resident encrypted parasitic viruses. They search for COM files, then write themselves to the end of the file. If a default drive is C: drive, the viruses erases the system sectors of C: drive and display:
Champaigne Livesall
The viruses also contain the string:
by KrACkBaBy
"Champaigne.706" does not erase disk sectors, but appends to the end of non-COM files the text:
Piggy Virus-v2.01.a by kRaCkBaBy...hE LiVES inSiDE mY mouTh, anD tELLz mE
whAt To sAY...whEn hE TUrNz tHA tRAiNz oN hE maKeZ iT gO aWaY...tHE HAnDz
aRe kRACkEd aND DiRtY ANd tHE nAiLz aRe BEeTLe WiNGs...anD tHERe iZ nO oNE
HerE tO sAVE oUrSeLf!!
This virus also writes to the C:AUTOEXEC.BAT file the command:
@echo !OiNk OiNk OiNk...goEs tHA Piggy!
Chance.a
Description Chance.a
This is a benign memory resident stealth boot virus that hooks INT 13h, and writes into floppy disk boot sectors and the C: drive. On 8 December, it decrypts and displays the message:
"All we are saying is give peace a chance" (J. Lennon)
It also contains the internal encrypted text string:
The John Lennon virus wishes love and peace to everyone
who's got the chance to read this! All my loving to INO!!
|