QDao.1589
Description QDao.1589
It is not a dangerous memory resident encrypted parasitic virus. When an infected file is executed, the virus writes its code to the reserved track on the hard drive (track/head 0/0) and copies its INT 21h handler (3Eh bytes) to the Interrupt Vectors Table at the address 0000:0300. This handler intercepts file termination, then searches for EXE files, reads complete virus code from the hard drive sectors and writes it to the end of the file. As a result 1.5K virus needs only 3Eh bytes of the system memory.
On November 12, the virus displays messages in Chinese.
Check other viruses! Be aware! Use Antiviral Software
Armee.a
Description Armee.a
This is a dangerous memory resident boot infector. It infects the boot sectors of the hard drive and the floppy disks.
The virus infects the hard drive while loading from an infected floppy disk. Then it hooks INT 13h, and infects the floppy disks that are accessed - these floppies are infected by the "Brain" method. On February 7th the virus displays a message and erase the disk sectors:
Schafft die Schweizer Armee ab !
Armee.b
Description Armee.b
This is a dangerous memory resident boot infector. It infects the boot sectors of the floppy disks and the hard drive MBR.
The virus infects the hard drive while loading from an infected floppy disk. Then it hooks INT 13h, and infects the floppy disks that are accessed - these floppies are infected by the "Brain" method. On February 11th the virus displays a message and erase the disk sectors:
Ausländer raus aus der Schweiz !
|