Paz.2560.a
Description Paz.2560.a
It is not a dangerous memory resident encrypted multipartite virus. While executing an infected file the virus affects the MBR of the hard drive. Then it hooks INT 13h, 21h and writes itself to the end of COM and EXE files that are executed or opened. The virus does not infect the files COMMAND.COM and SCAN.EXE. It deletes the anti-virus databases CHKLIST.*. Depending on the system time it also hooks INT 15h and disables Keyboard Intercept (AH=4Fh) function.
The virus contains the text:
PAZ, por favor.
Check other viruses! Be aware! Use Antiviral Software
Ill.1016
Description Ill.1016
This is not a dangerous nonmemory resident encrypted parasitic virus. It searches for .COM files of a subdirectory tree, and writes itself to the end of the file. On every 5th infection this virus displays:
WARNING : USE ONLY ORGINAL PROGRAMS
DON^T COPY IT
and now .. I AM ILL !!
It also contains the string:
.. * *.com
Illusion.1330
Description Illusion.1330
These are very dangerous memory resident parasitic viruses. They hook INT 21h, and write themselves to the end of COM files that are executed or when a file's attributes are read or set. The viruses have bugs, and replicate themselves only under limited system environment variants, and in other cases, the viruses halt the system. The viruses delete the anti-virus data files:
ANTI-VIR.DAT CHKLIST.MS SMARTCHK.CPS AVP.CRC IVB.NTZ CHKLIST.TAV
On July 4th and Fridays that fall on the 2nd, the viruses erase hard drive sectors, the CMOS and display the following message:
-- IlluSioN viRus coded by ThE_WiZArD in Spain (1997) --
When you know that your time is close at hand
Maybe then you will begin to understand
Life down there is just a strange Illusion all
The viruses also contain the text:
->#ThE_WiZArD
|