Phantasmagoria
Description Phantasmagoria
It is not a dangerous nonmemory resident parasitic virus. It searches for .COM files of the current directory and writes itself to the end of the file. Before return to the host program it decrypts and displays the message:
PHANTASMAGORIA ! Sleep Well
It set INT 20h to JMP RESET instruction and if the host program terminates by INT 20h call, the computer reboots.
Check other viruses! Be aware! Use Antiviral Software
Exe-vb.529
Description Exe-vb.529
This is harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed. The virus does not manifest itself in any way, it contains the ID-string "VB" at the end of infected files.
ExeBug.a
Description ExeBug.a
This is a family of boot and multipartite stealth viruses. They hook INT 13h and write themselves to the MBR of the hard drive and boot sectors of the floppy disks. Multipartite viruses of that family overwrite the headers of EXE file with a virus dropper. Other viruses overwrite the EXE files with trojan programs that erase the hard drive sectors when infected files are executed.
It uses a program trick to load itself into the memory after cold reboot and loading from clean system floppy (that trick works under limited types of BIOSes, see also "Ugly" virus). The virus disables the floppy drives by erasing corresponding areas in the CMOS, and enables the floppy drives after loading from infected hard drive. As a result the loading procedure goes in that way: the BIOS checks the floppy disk and does not find them, then checks the hard drive and detects it, and then loads the system from the hard drive that is already infected. The virus receives the control, enables the floppy drives, and passes the control to the floppy boot sector.
|