Virus Database

Shark.1027

Description Shark.1027

This is a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed. Depending on the number of virus generation this virus erases the random selected hard drive sectors. On February, 17th it displays the message:
The Tiny Shark virus was hereall(C) Stefano Toria 1993 Rome
Then it erases the C: drive sectors. The virus contains the text strings:
Made in Italy
Prince&NPG
Billy Idol

Check other viruses! Be aware! Use Antiviral Software

Gly.1182

Description Gly.1182

It is not a dangerous memory resident partly encrypted parasitic virus. It writes itself to the end of .COM files. When an infected file is executed, the virus infects the C:COMMAND.COM file, then hooks INT 21h and infects .COM files on DOS calls FindFirst/Next FCB (DIR command). If an infected program is executed on May 25th at 13:xx, the virus displays the message and plays a tune:
Happy birthday to you,Dear Yang !

The virus also contains the text strings:
G L Y Serial Number:

GmSpirit.2655

Description GmSpirit.2655

It is not a dangerous memory resident polymorphic parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. The virus does not manifest itself in any way. The virus contains the text strings:
[GM.Spirit]
[v1.10]
[Author: Green Monster, Russia]
We live in XMSall

The virus uses many complex programming tricks:
- it stores its TSR copy in the XMS memory and leaves in DOS memory just a small routine that hooks file execution, then allocates a block of DOS memory, copies to there the main virus body from the XMS, and executes it;
- when other programs are executed, the virus is able to move this routine in DOS memory;
- to intercept file execution the virus scans DOS kernel and patches DOS handler code with JMP_Virus instruction;
e.t.c.

Home