BadBoy.1074.a
Description BadBoy.1074.a
This is a harmless memory resident parasitic encrypted virus. It hooks INT 21h and writes itself at the beginning of COM files are executed. This virus uses System File Table on infection. It is divided on 9 blocks of code and data (installation block, data block, INT 21h block e.t.c.). When the virus installs itself into the memory, 8 of these 9 blocks can be rearranged in any order depending on the system timer. On infection the virus saves encrypted image of its TSR copy into the file, so orders of code blocks in two infected file can be different.
The virus contains the text:
The Worthless Piece of shit vi-rus that is a joke
Check other viruses! Be aware! Use Antiviral Software
Assassin.4834
Description Assassin.4834
It is not dangerous not memory resident encrypted parasitic virus. It searches for EXE-files and writes itself at their ends. It displays the message and manifests itself with video effect:
Assassin_II.959
Description Assassin_II.959
It is a dangerous memory resident parasitic stealth virus. It intercepts two functions of INT 21h (CloseFile and ReadHandle) and writes itself at the beginning of COM- and EXE-files that are closed. The original beginning of the file is saved out of file body by the manner of the "Beast" virus. On reading from the file the virus substitutes the infected file with its original form.
The virus uses several complex tricks. On installation it does not hook INT 21h, but modifies the not documented DOS tables to pass the control to the virus body on file closing and on reading from the file. That can cause the system to crash. While infecting the file, the virus uses not documented System File Table and INT 2Fh calls.
The virus contains the internal text string:
This is [Assassin] written by Dark Slayer in Keelung. Taiwan <R.O.C>
|