Virus Database

SanLorenzo Family

Description SanLorenzo Family

These are dangerous memory resident parasitic encrypted viruses. They hook INT 21h and write themselves to the end of the files that are executed. "SanLorenzo.1025" infects COM files, "SanLorenzo.1355" infects EXE files. While infecting a file the viruses delete the CHKLIST.MS file, if it exists, and overwrite the ANTI-VIR.DAT file with the string:
"SanLorenzo.1025": tbcheck
"SanLorenzo.1355": TBcheck

When the F-PROT.EXE file is executed, "SanLorenzo.1025" displays:
Not enough memory

Depending on the system date and time "SanLorenzo.1025" display the messages, then waits for SPACE keystroke:
SAN LORENZO CAMPEON 1995
by Mantis King
El Ciclón de Boedo se la banca, tiene aguante !
Boca sos puto, policía y cagón !
Abuelo Comisario
Globo no existis. En el Bajo Flores vas a morir, sucio !

On 15th of any month "SanLorenzo.1355" displays the message and halts PC:
Capaz de reprimir con palos y armas a tus propios hermanos que luchan reclaman-
do Justicia e Igualdadallte haces llamar DEFENSOR DE LA LEY Y EL ORDEN. Tu sola
presencia da asco y repugnancia.
Virus ANTI-YUTA, (C) Karl Xram, Abril 95

Check other viruses! Be aware! Use Antiviral Software

Graced.1389

Description Graced.1389

It is a harmless memory resident parasitic stealth virus. It hooks INT 21h and writes itself to the end of COM files that are accessed. It does not infect the files: TLINK*.*, TASM*.*, BC*.*, BCC*.*. The virus has a subroutine that infects EXE files, but it never takes control. The virus contains the text:
Graced. Version 1.00 .

GranGrave.1150

Description GranGrave.1150

It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are accessed. When DOS functions GetDiskSpace or DeleteFCB (AH=13h,36h) are called, the virus search for EXE files of the current directory, and infects them. The virus checks the name of the file, and does not infect the file if its name contains "V" or "S" symbols, or begins with: "CL", "HW", "TB", "F-", "WC", or "TK".
Depending on the system timer the virus displays the message:
Burglar/H

The virus also contains the text strings:
AT THE GRAVE OF GRANDMAall
CLHWTBF-WCTK
*.*

Home