Virus Database

Pizelun.3599

Description Pizelun.3599

It is not a dangerous memory resident parasitic encrypted virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are accessed. On DOS calls GetDir it searches for the files and infects them. On May, 1995 it hooks INT 8, 10h, 15h also and manifests itself in different ways: blinks with Num/Caps/ScrollLock indicators, changes the video palette, lower-cases the strings are displayed, intercepts Alt-Ctrl-Del and halts the system with video and sound noise, displays the message:
PIZELUN attivato, attivatissimo!
Premere un tasto per continuare . . .

It also contains the text string:
Alüra? ALF

Check other viruses! Be aware! Use Antiviral Software

Constructor.DOS.NRLG

Description Constructor.DOS.NRLG

NRLG (NuKE Randomic Life Generator) constructor creates encrypted memory resident COM/EXE DOS viruses. While creating a virus, the user may select the en/decryption code - the virus generates random selected codes and displays them on the screen.

Constructor.DOS.PS-MPC

Description Constructor.DOS.PS-MPC

PS-MPC (The Phalcon/Skism Mass-Produced Code Generator) is the second most known virus constructor, after VCL. The features of that constructor are described in the documentation that is distributed in the main PS-MPC package:
The Phalcon/Skism Mass-Produced Code Generator is a tool, which generates
viral code according to user-designated specifications. The output is in
Masm/Tasm-compatible Intel 8086 assembly, and it is up to the user to
assemble the output into working executable form. The features of the
PS-MPC include the following:
- Over 150 encryption techniques, randomly generated during each
run of the PS-MPC
- Compact, commented code, much tighter than VCL
- COM/EXE infections
- Both resident and nonresident viruses
- Two types of traversals for nonresident viruses
- Three types of high memory residency routines for TSR viruses
- Optional infection of Command.Com
- Critical error handler support

The PS-MPC constructor was released in 1992 and distributed in source code as well as in executable files. That is one of the most popular constructors, and several other constructors G2, IVP were created by using the PS-MPC sources.
That constructor creates source ASM files of the virus. The user can select the virus features: encrypted or not, memory resident or not, COM/EXE/COM and EXE infection, effects etc.
It seems that the viruses from "Arcv" family are based on PS-MPC constructor.

Home