Sampo
Description Sampo
This is a benign memory resident boot virus. It hooks INT 9 and 13h and writes itself into the MBR of the hard drive and floppy boot sectors. It intercepts when Alt-Ctrl-Del are clicked on, emulates rebooting and stays memory resident. In some cases, it drops the "Telefonica.3700" boot virus. On November 30, it hooks INT 8 also, and displays the following message:
+--------------------------+
¦ S A M P O ¦
¦ "Project X" ¦
¦ Copyright (c)1991 by the ¦
¦ SAMPO X-Team. All rights ¦
¦ reserved. ¦
¦ University Of The East ¦
¦ Manila ¦
+--------------------------+
Check other viruses! Be aware! Use Antiviral Software
Dowcipas.2303
Description Dowcipas.2303
It's a memory resident not dangerous parasitic virus. It hooks INT 08h, 15h and 21h. It infects COM- and EXE-files are executed. It traces INT 21h upon installation. Sometimes it changes the keyboard flags (Shift, Alt, Ctrl) and types one of the messages:
Incorrect DOS version.
KONIEC PRACY. WYLACZ KOMPUTER!!!
Twoj procesor przecieka
Jestem glodny! Wloz hamburgera (bez ketchupu!!) do stacji A:
Jestem spragniony! Wlej Coca-Cole do napedu B:
Jestem madrzejszy od ciebie 3.1415926535xOKO razy
UWAGA!!. Stacja C: wciaga tasme!!!
Nudzi mi sie-DRUKARKA.
Co ty robisz?? Pisac nie umiesz? -KLAWIATURA
DARK DOWCIPAS v.1.00 by Piotr Z. & Marcin I. (c)1992
Downloader.Win32.Harnig
Description Downloader.Win32.Harnig
This Trojan is written in Assembler.
Installation
Harnig copies itself as an .exe file and a .dll file with the same random name in the Windows directory. The .exe version is registered in the system registry auto-run key as:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
The Trojan also creates the following file in the Windows directory:
WININIT.INI
Malicious effects
Harnig downloads Backdoor.Afcore.aa from http//system.hoha.ru/x.pl?10 and launches it. Backdoor.Afcore.aa functions identically to Backdoor.Afcore.q
|