S-Gnome.654
Description S-Gnome.654
It is not a dangerous nonmemory resident encrypted parasitic virus. It searches for .COM files, then writes itself to the end of the file. The virus deletes the anti-virus databases: CHKLIST.MS, CHKLIST.CPS. On April 1st it sets new current date: January 1st 2000. On Fridays 13th it outputs random data to the printer. At 1:30am it displays the message:
REDRUM
WORKING v4.4 -GK-=!AssGnomes!=- 1997
The virus also contains the text:
One ring to rule them allall
Check other viruses! Be aware! Use Antiviral Software
Billiard.2658
Description Billiard.2658
It is not a dangerous memory resident partly encrypted parasitic virus. When an infected program is executed, the virus decrypts its encrypted block of code by using INT 1 (tracing) tricks, hooks INT 9 (keyboard) and stays memory resident. On INT 9 calls the virus releases INT 9 and hooks 2Fh. On INT 2Fh calls the virus releases INT 2Fh and hooks INT 9 (as a result at any moment the virus hooks either INT 9 or INT 2Fh).
On INT 2Fh calls the virus also intercepts the INSTALLATION CHECK (AX=AE00h) command that is executed when a copy of COMMAND.COM processor is run, checks the command line, and if command line begins with "DIR" string the virus searches for .COM amd .EXE files and writes itself to the end of the file. While working DIR command the virus temporary hooks INT 21h and "decreases" the length of infected files when they are accessed by FindFirst/Next DOS functions.
On 31st of months the virus manifests itself by a video effect - it runs the symbols on the screen like playing billiard.
Billy.836
Description Billy.836
Billy.836 is a harmless not memory resident parasitic virus. It searches for EXE-files and writes itself at their ends. It contains the internal text strings:
*.EXE
Hi folks, I'm the Billy Ray Virus and I'm here to sing my number one
smash hit, Achey Breaky Hard Disk.
+------ ++
____=-+------¦ --------------+ / ¦
____=-¦ @ +++ ¦ ¦_ ¦
____=-¦ -> ¦_¦_=- °°°¦--------¦---¦
____=-¦ @ +++ ¦ ¦_ ¦
____=-+------¦ ------/---------+ ¦
+------ ++
|