Virus Database

OS2.AEP.a

Description OS2.AEP.a

It is a harmless nonmemory resident parasitic NewEXE (OS/2) virus. It searches for EXE and DLL files, checks them for an NE stamp, then checks the OS/2 marker in the NewEXE header. Next, the virus obtains the number of the code segment that is the entry point segment, shifts down all other segments, then increases the length of the entry point segment, and writes its code there. Then the virus fixes the relocation and name tables and returns the control to the host program.
Clean File Infected File
+----------------+ +----------------+
ƒMZ DOS Header ƒ ƒMZ DOS Header ƒ
ƒ----------------ƒ ƒ----------------ƒ
ƒNE NewEXE Headerƒ ƒNE NewEXE Headerƒ
ƒ----------------ƒ ƒ----------------ƒ
ƒSystem Tables ƒentryƒ ƒSystem Tables ƒ
ƒ----------------ƒpointƒ ƒ----------------ƒ
ƒSeg 1 ƒ<----+ ƒSeg 1 ƒ<--+
ƒ ƒ ƒ ƒ ƒ
ƒ----------------ƒ --+ ƒ- - - - - - - - ƒ<---- entry point
ƒSeg 2 ƒ ƒ ƒVirus ƒ ƒ
ƒ----------------ƒ ƒ ƒ ƒ---+ returns to original
. . . +--> ƒ----------------ƒ entry point
ƒ----------------ƒ ƒSeg 2 ƒ
ƒSeg n ƒ ƒ----------------ƒ
+----------------+ --+ . . .
ƒ ƒ----------------ƒ
ƒ ƒSeg n ƒ
+--> +----------------+

This is the first known virus that affects OS/2 files in the "right way" - it writes itself to the file and modifies the NewEXE header and other system areas.
While infecting a file, the virus uses the system calls:
DosAllocSeg DosFreeSeg DosChgFilePtr DosClose DosFindFirst DosFindNext
DosOpen DosRead DosWrite

The virus contains the text strings:
(C) 1995 American Eagle Publications Inc., All rights reserved.
*.EXE *.DLL DOSCALLS



Text added: June-26-1996

Check other viruses! Be aware! Use Antiviral Software

AZ.492

Description AZ.492

This is a very dangerous memory resident parasitic virus. It hooks INT 21h and overwrites the files that are executed ot opened.
The virus contains the text strings:
AUSCHWITZ v2.11

AZ.518

Description AZ.518

This is a very dangerous memory resident parasitic virus. It hooks INT 21h and overwrites the files that are executed ot opened.
The virus contains the text strings:
AUSCHWITZ v2.08

Home