Virus Database

RMC.1551

Description RMC.1551

It is a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of .COM and .EXE files that are executed or opened. On February, 16th it halts the computer and displays the message:
_ _ _ __ __ _ _ __ _ __ ___ _ _ __ _ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
___ ___ __ __ _ _ __ _ __ _ ___ _ _ ___ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _ _ _ _ _ _ __ _ _ _ _ _ _ __ _ _ _
_ _ _ __ ___ ___ _ _
___ _ _ _ _ _ _ _ _
_ _ _ __ _ __ ___ _
_ _ _ _ _ _ _ _ _
_ _ _ _ _ ___ ___ _ _ _
THIS VIRUS WAS MADE BY RACASAN MIRCEA AND TODAY IS HIS BIRTHDAY.
SO, GO AHEAD AND CELEBRATE, AND IF YOU WANT TO WRITE HIM, HERE IS
HIS ADDRESS :
LEODINGER STRAßE 1/11
A-4050 TRAUN
ÖSTERREICH

The virus also contains the ID-string:
RMC16277

Check other viruses! Be aware! Use Antiviral Software

DarkElf (boot)

Description DarkElf (boot)

It is a dangerous memory resident stealth boot virus. It hooks INT 3, 8, 13h and writes itself to the boot sectors of the floppy disks that are accessed. While infecting a disk the virus stores its second sector and original boot sector to the FAT sectors, and infects correctly 360K floppy disks only. While installing memory resident, if the virus cannot locate the original boot sector, it formats the disk sectors, then display and prints the message:
The Dark Elf strikes again!

It also contains the text strings:
V.I.R.U.S. Rules!
DARKELFv0.1

DarkElf family

Description DarkElf family

These are harmless memory resident encrypted parasitic viruses, "DarkElf.3691" is a polymorphic virus. They hook INT 21h and write themselves to the end of COM and EXE files that are executed or opened. The viruses do not infect the files: AIDS*.EXE, DRWEB*.EXE, WEB*.EXE, SCAN*.EXE, -*.*, AVP*.*, AVSP*.EXE, TB*.EXE, COMMAND.COM, IBM*.*, WIN*.COM
The viruses use several levels of encryption as well as several anti-debugging tricks. They contain the text strings in Russian and:
"DarkElf.2200":
[Dark Elf] version 2.1 CopyLeft (cl) MSTUdent
18/08/96 03:50:30
AIDS????EXEDRWEB???EXEWEB?????EXESCAN????EXE-??????????AVP????????
AVSP????EXETB??????EXECOMMAND?COMIBM????????WIN?????COM

"DarkElf.3691":
[Dark Elf] version 3.0 CopyLeft (cl) MSTUdent
13/11/96 18:04:13
AIDS????EXEDRWEB???EXEWEB?????EXESCAN????EXE-??????????AVP????????
AVSP????EXETB??????EXECOMMAND?COMIBM????????WIN?????COM
[DEME] Dark Elf Mutation Engine v1.0 CopyLeft (cl) MSTUdent
13/11/96 18:04:13

Home