Virus Database

Phonix.927

Description Phonix.927

It is a very dangerous memory resident parasitic virus. Being executed it infects the COMMAND.COM file and returns to the host program. Being executed with infected COMMAND.COM the virus hooks INT 21h and then writes itself to the end of COM and EXE files that are closed. On Friday, 13th it erases the hard disk sectors, displays "Phönix" and halts the computer.

Check other viruses! Be aware! Use Antiviral Software

CS.Gala

Description CS.Gala

This is the first known virus to infect CorelDraw scripts. When this script is activated, it searches in the current folder for other CorelDraw scripts (*.CSC files), reads their data and gets names of the first infected and first non-infected scripts. Then it reads the virus code from the infected script and writes it to the beginning of victim non-infected script. The virus infects one script at a time, and after infection, it returns control to the original script commands.
While infecting, the virus uses the temporary file MALLORN.TMP: the virus renames the victim file to this name, creates its copy with a victim file name, and appends to it the original victim file code from a MALLORN.TMP file.
The virus manifests itself on June 6th - it displays the following message window:
GaLaDRieL ViRUS bY zAxOn/DDT
Ai! lauri" lantar lassi sêrinen!.
YLni ênãtime ve rmar aldaron,
yLni ve linte yuldar vnier
mi oromardi lisse-miruvãreva
Andêne pella Vardo tellumar
nu luini yassen tintilar i eleni
ãmaryo airetri-lirinen.
all.

The virus code also contains comments at the very beginning of the virus and at the very end of its code:
REM ViRUS GaLaDRieL FOR COREL SCRIPT bY zAxOn/DDT
REM END OF ViRUS GaLaDRieL bY zAxOn/DDT

The possibility of CorelDraw script infection is based on the fact that this application supports programs that are written in a script language that is very close to VisualBasic used in MS Office. The CorelDraw scripts, as well as scripts in other applications and macros in MS Office, are used to customize the application. The CorelDraw script language supports a set of instructions that is enough to copy one script code to another one, access disk files and as a result to create a virus.

Csf.240

Description Csf.240

It's a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the beginning of COM-files that are executed. It contains the internal text string: "csf".

Home