Virus Database

Sarov.1200

Description Sarov.1200

This is a harmless memory resident parasitic polymorphic virus. It hooks INT 1, 8, 9, 21h and writes itself to the end of COM files that are accessed with DOS calls FindFirst/Next. By hooking INT 1 (tracer) the virus disables the tracing their code. By hooking INT 8 (timer) the virus change the floppy disk status, and calls the keyboard effect: by hooking INT 9 the virus 'skips' some keys that are pressed. The virus contain the text stings:
[BIL_92_Sarov]

Check other viruses! Be aware! Use Antiviral Software

Peach.887

Description Peach.887

It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files. It writes 13h bytes of Jmp-Virus routine to the beginning of COM files.
The virus deletes the CHKLIST.CPS file, and sometimes writes to the BIOS data area at the address 0040:00FC the string:
Roy CuatroNo 2 Peach GardenMeyer Rd. Spore 1543

Peasant.1243

Description Peasant.1243

This is a dangerous memory resident parasitic virus. When an infected EXE file is executed, the virus searches for a command interpreter (COMMAND.COM) by using the string "COMSPEC=", and overwrites it. The virus stores the part of the code that is overwritten into the unused sectors of the hard drive, then the virus returns control to the host program.
When an infected COMMAND.COM is executed, the virus reads its original code from the hard drive sectors, hooks INT 21h and returns control to COMMAND.COM. Then the virus writes itself to the end of EXE files that are accessed.
On Mondays, it disables the DOS functions SetDir, RemoveDir and ChangeDir; and when the files are deleted, it "hides" them with corresponding attributes, upon writing to files, the virus appends to them with the string:
"""NoImportRICE!"""

It displays the same string while terminating the programs. The virus also contains the text string:
(c)KoRea-PeaSant

Home