Virus Database

Pempe family

Description Pempe family

These are not dangerous memory resident parasitic viruses, "Pempe.1943" encrypted. They trace INT 13h, 21h, hook INT 8, 21h and on disk access DOS calls search for .EXE files and write themselves to the end of the file. Depending on their counters the viruses decrypt and display the message:
+-----------------------------+
| P E M P E |
| AMACC (Makati,Phils) [PM] |
+-----------------------------+

The "Pempe.1811" virus also contains the text:
PEMPE 1.2

Check other viruses! Be aware! Use Antiviral Software

Mity.1982

Description Mity.1982

It is not a dangerous memory resident multipartite virus. When an infected file is executed, the virus writes its code to the last sectors of C: drive and modifies the disk partition table in such way, that active boot sector address points to the virus code (see "Starship" virus). The virus then returns to the host program.
While booting from infected disk the virus hooks INT 13h, waits for DOS loading process, hooks INT 21h and then infects COM and EXE files that are executed. The virus writes itself to the beginning of COM file and to the middle of EXE files.
Depending on its counters the virus displays the text:
XXXX XXXX XXXXXXXX XXXXXXXXXX XXX XXX
XXXXXX XXXXXX XXXXXXXX XXXXXXXXXX XXXXX XXXXX
XXXXXXXXXXXXXXX XXXX XXXX XXXXXXXXX
XXXX XXX XXXX XXXX XXXX XXXX
XXXX XXXX XXXX XXXX XXXXX
XXXX XXXX XXXX XXXX XXXXX

Mix.2280

Description Mix.2280

This is a dangerous encrypted memory-resident parasitic virus. It hooks INT 8, 9, 14h, 17h, 21h and writes itself to the end of COM files that are loaded into the memory.
The virus contains the text:
Strike the pauseVogue, you got to Let your body move with the music
I can leave you , say goodbye , i can love u if i try all...
Left to my own devices i probely could.
The virus manifests itself by changing some characters as they are sent to COM or LPT ports. It changes background color when Ctrl-Alt-Del are pressed, causes "characters falling", or launches a ball, bouncing around the screen frame. An infected file contains the text "Mix1" or "Mix2" at its end.

Home