Virus Database

RagDoll.942

Description RagDoll.942

It is not a dangerous memory resident parasitic virus. It copies itself into EMS memory, hooks INT 21h and writes itself to the end of EXE files that are executed. Being debugged the virus halts PC. The virus detects TBAV memory resident anti-virus monitor, and displays:
TbDriver, TBAV TSR utilities driver (C) Copyright 1992-94 Thunderbyte BV.
_ Program not supported.

The virus also contains the text string:
Rag Doll Virus by Sx (c) 1995 AeroSmith Rulze!!

Check other viruses! Be aware! Use Antiviral Software

Markiz.2620

Description Markiz.2620

This is a dangerous memory resident encrypted parasitic virus. It traces and hooks INT 21h, then it infects COM and EXE files. The virus contains the text strings:
[-DEDiCA+ED-Ï0-MARKiZ-]
This virus writes itself to the beginning of COM files and to the end of EXE files that are accessed with DOS functions FindFirst/Next ASCII (AH=4Eh,4Fh). These functions are performed by DOS while executing a file from the command line, and the virus infects that file at that moment. The virus checks the file name before infecting, and does not infect the file if there are any of the following strings found at the beginning of a file name:
ADIN AID ANT DRW FIND MSA NAV VSA WEB

With a probability of 1/256 while executing the FO?MA*.EX* files (FORMAT.EXE), the virus renames them to *.?d? ('d' - 229 ASCII).
In February and October, some time after installation, the virus displays messages, and manifests itself with video and sound effects.

Markiz_II Family

Description Markiz_II Family

These are not dangerous parasitic viruses. "Markiz.1024" is a nonmemory resident virus. It searches for EXE files and writes itself to the end of the file. "Markiz.2642" is an encrypted memory resident virus. It hooks INT 21h and infect files that are executed. It writes itself to the beginning of COM and to the end of EXE files except files (anti-viruses): AIDS, ANTI, WEB, -V, SCAN, VSAFE, MSAV, NAV.
On 28th of any month "Markiz.1024" displays the message:
Virus ***MARKIZ-1*** for EXE files specification.
(C) by PLcat /demo version 1.0/
Was great in Almaty, Kazakhstan, 28.12.94. Good luck!

Under debugger "Markiz.2642" displays the message and reboots the computer:
+------------------------------------------------------------+
¦ Virus *** MARKIZ-2 *** for COM&EXE&OVL files specification ¦
¦ (C) by PLcat, version 2.0 /experimental version/ ¦
¦ Created in Almaty, Kazakhstan, 21.05.95. ä" ¡"óds óßGaÑt! ¦
+------------------------------------------------------------+

This virus also hooks INT 8 (timer) and in some time displays the picture:
+------------------+
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦/¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦/ ¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦--¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ ¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦ M A R K I Z -- 2 ¦
+------------------+

Depending on the system date it also hooks INT 9 (keyboard) and on Alt-Ctrl-Del (warm reboot) manifests itself by a video effect.

Home