Virus Database

Backfont.765

Description Backfont.765

These are memory resident parasitic viruses, they hook INT 21h and write themselves at the end of EXE-files are executed.
Backfont.900,905
These are not dangerous viruses. They hook INT 8 and 21h. They contain no text strings, manifest themselves depending on their internal counters and the current year, month, day and only if EGA-adapter is present. You can see a rather interesting video effect: approximately 20 min after the virus activation all symbols displayed on the screen "flip", i.e. "/," -> "`". (shown approximately). The symbols remain in their places, only their view is changed. Approximately 10 seconds later the original state of the screen will be restored, next 10 sec. later the symbols will flip ones more etc.
Backfont.765,821
These are dangerous viruses. Upon every call of the ChDir DOS function (INT 21h, ah=3Bh) they set one of FAT cluster to BAD (pseudobad cluster).
Backfont.896
It's a harmless virus. It doesn't manifests itself.
Backfont.1172
It's a not dangerous virus. It hooks INT 8, 21h. Sometimes it decrypts and types the message in Russian.

Check other viruses! Be aware! Use Antiviral Software

Samara.1536

Description Samara.1536

It is not a dangerous memory resident multipartite polymorphic virus. When an infected file is executed, the virus affects the MBR of the hard drive, then hooks INT 21h and writes itself to the end of COM and EXE files (except COMMAND.COM) that are accessed. The virus cancels anti-virus programs execution: AVPLITE, AIDSTEST, AVP, DRWEB, SCAN.
On loading from infected MBR the virus hooks INT 13h, waits for DOS loading process and hooks INT 21h. On loading from infected floppy disk the virus also infects the hard drive MBR.
While infecting the MBR and boot sectors the virus does not stores their original contents. To continue loading under infected environment the virus reads and executes the first sector on the C: drive. This sector usually contains standard OS loading routine.

Sampo

Description Sampo

This is a benign memory resident boot virus. It hooks INT 9 and 13h and writes itself into the MBR of the hard drive and floppy boot sectors. It intercepts when Alt-Ctrl-Del are clicked on, emulates rebooting and stays memory resident. In some cases, it drops the "Telefonica.3700" boot virus. On November 30, it hooks INT 8 also, and displays the following message:
+--------------------------+
¦ S A M P O ¦
¦ "Project X" ¦
¦ Copyright (c)1991 by the ¦
¦ SAMPO X-Team. All rights ¦
¦ reserved. ¦
¦ University Of The East ¦
¦ Manila ¦
+--------------------------+

Home