Virus Database

Rikki family

Description Rikki family

These are not dangerous nonmemory resident parasitic viruses. They search for .COM files, then writes itself to the end of the file. While infecting a file they temporary rename it with COx (x=FFh) extension. To rename file the viruses do not call any DOS function, but make it by absolute disk read/write calls (INT 25h/26h) - the viruses read directory entry, search for file name, patch it and then write directory sector back to disk.
The viruses display the messages:
"Rikki.839":
Demo virus #1 by Rikki Cate 21/9/90
File infected:
Press key to continue

"Rikki.1787":
Demo virus #3 by Rikki Cate 21/9/90
File infected:
Press key to continue

"Rikki.1970"
Demo virus #2 by Rikki Cate 21/9/90
File infected:
Press key to continue
PC-cillin has been replaced by a demonstration virus. To activate the
virus, reboot the computer.
PC-cillin has been replaced by a demonstration virus.
This message could easily duplicate the PC-cillin start-up screen.
The virus is now resident in memory in place of PC-cillin. It
will emulate the PC-cillin display and command keys. It will also
infect any .COM programs which are accessed by interrupt 21 hex.
Press any key to continue.

Check other viruses! Be aware! Use Antiviral Software

Manuel family

Description Manuel family

These are memory resident parasitic viruses. They hook INT 21h and write themselves to the end of .COM files (except COMMAND.COM) that are executed or opened.
"Manuel.1155" searches for .COM files and infects it on DOS function GetDiskSpace (AH=36h) calls. While executing an infected file the virus infects the files from the list:
C:DOSFORMAT.COM
FORMAT.COM
C:DOSKEYB.COM
KEYB.COM

In some cases while installing the viruses display the messages:
"Manuel.777": Soy un Manuel Virus de tipo G
"Manuel.814": Soy un Manuel Virus de tipo N
"Manuel.840": Soy un Manuel Virus de tipo B
"Manuel.858": Soy un Manuel Virus de tipo L
"Manuel.876": Soy un Manuel Virus de tipo R
"Manuel.937": Soy un Manuel Virus de tipo C
"Manuel.957": Soy un Manuel Virus de tipo C
"Manuel.972": Soy un Manuel Virus de tipo B
"Manuel.995": Soy un Manuel Virus de tipo H
"Manuel.1155": Soy un Manuel Virus de tipo H
"Manuel.1388": Soy un Manuel Virus de tipo M

"Manuel.777,814,876" are not dangerous viruses, they does not manifest themselves in other ways.
"Manuel.840,972" are very dangerous viruses. Depending on their internal counters they delete the files instead of infecting them.
"Manuel.858" is not a dangerous one, depending on its internal counters it hooks INT 8 (timer) and delays on every timer tick.
"Manuel.937,957" erase CMOS memory.
"Manuel.995,1135" corrupt the disk sectors and display the message:
Manuel Virus: to repare HD, rotate rigth the sector (not the bytes)
number 2, head 0, of tracks 0 to length of this message

"Manuel.1388" plays a tune.
Manuel.2209
It is an encrypted virus. It infects both .COM and .EXE files. Depending on the system date the virus beeps with PC speaker. While executing an infected file the virus receives the control and infect the files:
C:DOSCOMMAND.COM
DOSCOMMAND.COM
COMMAND.COM
COMMAND.COM

This virus also contains the text strings:
c:doscommand.COM
Manuel strikes again

Manzon Family

Description Manzon Family

These are harmless memory resident polymorphic parasitic viruses. They hook INT 21h and write themselves to the end of COM and EXE files that are executed or closed. The viruses contain the text strings:
"Manzon.1404,1414": MANZON (c) Sgg1F5PZ
"Manzon.Burning": tHe bURnInG zOnE CWUR_UUM
"Manzon.Variant": MANZON Variant 1

Home