Virus Database

Rushhour Family

Description Rushhour Family

These are very dangerous memory resident parasitic viruses. They hook INT 10, 21h and overwrite KEYBGR.COM (if it exists in the current directory) while executing any program. Depending on their counters these viruses manifest themselves with a noise (by PC speaker). The viruses contain the text strings:
This program is a VIRUS program.
Once activated it has control over alls
ystem devices and even over all storage
media inserted by the user. It continually
copies itself into uninfected operating
systems and thus spreads uncontrolled.
The fact that the virus does not destroy any
user programs or erase the disk is merely due
to a philanthropic trait of the authorall...

Check other viruses! Be aware! Use Antiviral Software

Gly.1182

Description Gly.1182

It is not a dangerous memory resident partly encrypted parasitic virus. It writes itself to the end of .COM files. When an infected file is executed, the virus infects the C:COMMAND.COM file, then hooks INT 21h and infects .COM files on DOS calls FindFirst/Next FCB (DIR command). If an infected program is executed on May 25th at 13:xx, the virus displays the message and plays a tune:
Happy birthday to you,Dear Yang !

The virus also contains the text strings:
G L Y Serial Number:

GmSpirit.2655

Description GmSpirit.2655

It is not a dangerous memory resident polymorphic parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. The virus does not manifest itself in any way. The virus contains the text strings:
[GM.Spirit]
[v1.10]
[Author: Green Monster, Russia]
We live in XMSall

The virus uses many complex programming tricks:
- it stores its TSR copy in the XMS memory and leaves in DOS memory just a small routine that hooks file execution, then allocates a block of DOS memory, copies to there the main virus body from the XMS, and executes it;
- when other programs are executed, the virus is able to move this routine in DOS memory;
- to intercept file execution the virus scans DOS kernel and patches DOS handler code with JMP_Virus instruction;
e.t.c.

Home