Virus Database

PI.2048

Description PI.2048

It is a very dangerous memory resident parasitic virus. It hooks INT 8, 13h, 21h, 24h and writes itself to the end of EXE files that are executed or opened. If the day number is equal to the month number, and the minutes are equal to the hour, the virus formats the disk sectors. The virus contains the text strings:
PI v2.0 (C) 1995 BREAM.
Pretorianie niszcza aby tworzycall
Pozdrowienia dla p. Marka Sella skladaja pracodawcy.

Check other viruses! Be aware! Use Antiviral Software

LightNing.4251

Description LightNing.4251

It is a very dangerous memory resident parasitic polymorphic virus. It hooks INT 13h, 21h and writes itself to the end of COM and EXE files that are executed, opened, renamed or when file's attributes are accessed. The virus does not infect anti-viruses AIDSTEST, DRWEB, -V (former AVP), ADINF, SCAN and ANTI*.
When .PAS files are opened (Pascal source files), the virus searches for "BEGIN" string within a .PAS file and inserts a line of source code that either reboots the computer, or halts it:
inline($b9/$02/$00/$e2/$fb);
inline($ea/$f0/$ff/$00/$f0);

By hooking INT 13h the virus encrypts the sectors that contain text data. The virus contains the text strings:
"LightNing" (c) 12.95 by ML, Krasnodar
MetaMorphic Generator (MMG) v1.0
AIDRWE-VADSCAN

Lilith

Description Lilith

It is not a dangerous memory resident polymorphic and stealth boot virus. To hook INT 13h the virus scans the BIOS code for INT 18h call (CDh 18h), sets INT 13h to that address and hooks INT 18h. Then the virus writes itself to boot sector of the floppy disks and the MBR of the hard drive. Depending on the system timer the virus also hooks INT 5 (Print Screen) and when PrintScreen key is pressed, the virus displays:
L · I · L · I · T · H
Tu del creato prima Donna
del Sesso Maestra infernale
accogli le Nostre dannate Carni
nel Tuo satanico Ventre

The virus also contains the text string:
Milan Italy 95

Home