Virus Database

Sahan.896

Description Sahan.896

It is not a dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are accessed. The virus contains the text strings:
Clever boy !, you found me.I hate silly people.I'm Nice Fox
1.8e.Sahand-Tabriz University of Technology.

Check other viruses! Be aware! Use Antiviral Software

Hadi.6153

Description Hadi.6153

It is not a dangerous memory resident partly encrypted parasitic virus. It hooks INT 8, 9, 20h, 21h and writes itself to the end of COM and EXE files that are executed or closed. The virus is semi-stealth: on opening an infected file the virus disinfects it, on DOS calls FindFirst/Next the virus returns the original length of infected files. When the disk checking utilities are run, the virus disables its stealth routines. The list of these utilities looks as follows: CHKDSK.EXE, SCANDISK.EXE, NDD.EXE, SPEEDISK.EXE, SD.EXE, DEFRAG.EXE. The virus does not infect the files: DEBUG.EXE, TD.EXE, CV.EXE, SI.EXE, NCSI.EXE, SYSINFO.EXE, MSD.EXE, HJ2321.EXE.
Depending on the system date and its internal flags the virus displays the messages:
Hercul Hadi
by Hadi Javan Amirkhizi
03/07/1996
TABRIZ--IRAN
Call me to repair your system (if you find me)
Press CTRL key for 5 seconds to return

Hafen.781

Description Hafen.781

These are not dangerous nonmemory resident parasitic viruses. They search for .EXE files of the subdirectory tree, and write themselves to the end of the file.
"Hafen.1640,1641,1689" contain the decrypted body of "Ambulance" virus, and infect .COM files with this sample (drop the virus). "Hafen.809" decrypts and displays the message:
Hafenstraße bleibt !

"Hafen.781" decrypts and prints to the printer the message:
Kilroy was here - (C) 1991, VDV.

"Hafen.818" creates the files with the random names, these files contain the text:
Hafenstraße bleibt !

"Hafen.1191" manifests itself with a moving picture:

Home