Virus Database

Opera.1013

Description Opera.1013

This is a relatively harmless memory resident parasitic virus. The virus affects executable files of two different platforms: DOS COM files as well as Windows VxD drivers.
The virus installs itself into the DOS memory, allocates a block of memory, hooks INT 21h nnd 2Fh, and stays memory resident. The INT 2Fh hook is used by the virus only to detect its already installed TSR copy so as to prevent duplicate installing. The INT 21h hook is used to intercept file access functions such as file executing, opening, renaming, and file attributes read/write. When such a function is intercepted, the virus checks the file name extension and infects files that have a .COM or .VXD extension.
While infecting a DOS COM file, the virus moves a block of file code from the top to the file bottom, and writes its code to the file top. The host file code that is stored at the file bottom is written there in encrypted form.
A similar way is used while affecting VxD drivers, but the virus writes itself to the file middle at the address of a 16 bits VxD entry routine. The virus looks for the 16 bits entry in the VxD and infects only those that have such an entry. The virus then moves that routine to the file bottom and overwrites that address with its code.
On July 25th, and being run from an infected COM file, the virus decrypts and displays the following message:
Opera IX, Horned Beast/VADER

Check other viruses! Be aware! Use Antiviral Software

Hymn.1865.a

Description Hymn.1865.a

This is a very dangerous memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of COM and EXE files that are executed, closed, renamed or when the file attributes are changed.
When the date and month correspond in number (January 1st, February 2nd,all), this virus destroys a part of the system information in the C: disk boot sector, then it plays the former USSR national anthem, and decrypts and displays the picture.
When corrupting the boot sector, the virus sets the bytes to zero in the boot sector that contains the number of bytes in a sector, number of sectors in a cluster, number of FAT copies, etc - a total 9 bytes. If the boot sector of a computer running in the MS-DOS environment is changed in such a way, the computer remains unbootable both from the hard disk and the floppy drive. To restore information, it is necessary to use special utilities.

Hymn.1865.b

Description Hymn.1865.b

This is a very dangerous memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of COM and EXE files that are executed, closed, renamed or when the file attributes are changed.
When the date and month correspond in number (January 1st, February 2nd,all), this virus destroys a part of the system information in the C: disk boot sector, then it plays the former USSR national anthem, and decrypts and displays the picture.
When corrupting the boot sector, the virus sets the bytes to zero in the boot sector that contains the number of bytes in a sector, number of sectors in a cluster, number of FAT copies, etc - a total 9 bytes. If the boot sector of a computer running in the MS-DOS environment is changed in such a way, the computer remains unbootable both from the hard disk and the floppy drive. To restore information, it is necessary to use special utilities.

Home