Virus Database

Praios.747

Description Praios.747

It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are searched or accessed. On installing into the memory the virus uses anti-debug tricks. The virus contains the text string:
[Praios 2.0] by Slavemaster 1997/Germany

Check other viruses! Be aware! Use Antiviral Software

Ace.1872

Description Ace.1872

It is a very dangerous memory resident encrypted parasitic virus. Being executed the virus hooks INT 22h, returns the control to the host program, wait for termination of that program, then traces and hooks INT 21h and stays memory resident. Then the virus writes itself to the end of COM files that are executed and to OBJ files that are opened. The virus infects OBJ files that are to be linked to EXE files, and replaces the entry point of EXE files with the instruction CALL_Virus.
The virus checks the names of COM files and does not infect C*.* and W*.* files. While executing W*.* files the virus depending on the system date erases that file, displays the message and reboot the computer:
This program wastes a lot of memory,
SYSTEM HALTEDall

The virus also contains the text strings:
OBJ
(C) Ace of Spades , Kiev-1995... Don't be a snub - enjoy yourself!

ACG.a

Description ACG.a

It is a family of DOS parasitic viruses. There are several virus versions known: memory resident and nonmemory resident, infecting COM and/or EXE files. All of them write themselves to the end of the file and modify file header. Memory resident viruses hook INT 21h and infect files that are opened, nonmemory resident search for files in the current directory.
The viruses use highly complex polymorphic engine that rebuild virus code. In different infected files different assembler instructions or ever sets of instructions are used to do the same operation. The engine also mixes blocks of virus code and data, inserts junk instructions, inserts random data, etc. The virus also changes data offsets in its assembler instructions, constants and so on. As a result, the virus is not 100% encrypted, but it has no constant parts of code and ever the length of virus is changed.
Being installed into the memory the memory resident versions of the virus do not changes the virus code anymore, and all its replications have constant set of instructions. After reboot the virus installs itself into the memory and generates new set of instruction and infects files with this new set.
The viruses contain the text:
Internal compiler error!
LUCKY B.R.D 1994-99

Home