Virus Database

Qumak.1028

Description Qumak.1028

These are non memory resident enciphered parasitic viruses. They hit .COM-files of current directory and directories pointed in PATH string. Depending of current time they display: "Hello world from my virus!". They also contain the texts: "(C) DOCTOR QUMAK", "e stuff that should be here".
"Qumak.1161" formats the disk sectors.
"Qumak.1079" is a memory resident virus. It hooks INT 12h, 13h, 21h and infects the .COM-files on their execution or opening. It contains the encrypted text string:
The famous cooperation strikes again: IT IS DOCTOR QUMAK II!
Watch out for the next virus from Krak-w, Poland!

Check other viruses! Be aware! Use Antiviral Software

Tajfun

Description Tajfun
It is a harmless nonmemory resident parasitic virus. It searches for .COM files of the current directory and writes itself to the end of the file. It contains the text string:
tajfun1.0

Tajfun.593
It is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the end of .EXE files (except MK*.* files) that are executed. It contains encrypted text string:
TAJFUN$MK

TakeControl

Description TakeControl

It is a dangerous memory resident parasitic polymorphic virus. It writes itself to the end of EXE files and the COMMAND.COM file. Then an infected EXE file is executed, the virus infects C:COMMAND.COM and C:DOSCOMMAND.COM files, if they exist. Then the virus returns the control to host EXE program. The virus does not warry about internal COMMAND.COM format and corrupts that file, if it has EXE internal format (Win95 COMMAND.COM).
When an infected COMMAND.COM is executed, the virus hooks INT 21h, stays memory resident and infects EXE files that are executed.
The virus leaves in memory just a half of its code - about 2.8Kb, while infecting a file the virus reads its complete code from the C:COMMAND.COM file, and then writes this code to EXE files.
The virus checks the file names and does not infect the files from the string (four bytes per name - 3P.E*, AHEL*.*, ALIK*.*, APPE*.* and so on):
3P.EAHELALIKAPPEASTAATTRAVASAVG.AZORBINOBOOTBUILCHKDCLEADEFRDFA.DISK
DOSXDPMIDRVSDSWAEMM3EXE.EXEMEXPAF-PRFASTFC.EFDISFINDGPEGGUARHIEWINI.
INSTINTEKERNKRNLLABELGUAMAKEMANDMEMMMOVEMSBAMSCDMSD.MWBANAV.NLSFPAST
PCC.POWEREX.REPLRESTRTM.SCANSETVSHARSHIESMARSORTSUBSTB.ETEMCTRAPTSAF
UCOMUEXEUNDEVCOPVGUAVIRSVIRTVIRUVIVEVS.EVSHIWIN.WINSWSWAXCOP

Starting from July 1997 the virus displays the message and halts the computer:
TAKE CONTROL of yor mind, your body and your soul !!!
(I'm taking control of your machine - he, he, he all!)
Replace your C:COMMAND.COM and C:DOSCOMMAND.COM and it'll be O.K.
... forever!
Zdar Grisofte, McAfee nebo jiny pocitacovy maniaku, jenz tento virus pitvas.
*** Gratuluju ***
>>> Konecne jsi me dekodoval a dostal se az sem. <<<
At zije D.J.BOBO a jeho TAKE CONTROL!!!
--- Virus napsany specialne na podporu antivirovych firem. ---
### Preji ti uspesny boj se vsemi moznymi viry, jako je tento. ###
Grisofte, vase AVG je fakt dobry, ale ve verzi 4.0 pro Windows je dost chyb.
No nic, puvodni CS:IP u EXE nebo prvni tri byty u COMMANDu jsou tady --->

Home