Virus Database

Slow.1716

Description Slow.1716

This is a relatively harmless memory resident encrypted virus. It hooks INT 21h, and infects COM and EXE files that are executed. On Friday, it sets the date stamp to zero for files that are closed.

Check other viruses! Be aware! Use Antiviral Software

Ginger Family

Description Ginger Family

These are harmless memory resident stealth multipartite viruses. While executing an infected file the viruses infect the MBR sector of the hard drive. While infecting the viruses correct only the physical address of the Active Boot Sector (from which DOS is loaded), the viruses set this address to 0/0/2 (cylinder/head/sector) and write their code and data to that and followed sectors. As a result the viruses correct only three bytes in the MBR. While loading from an infected sector the viruses hook INT 13h, 21h and write themselves to the end of COM and EXE files that are accessed. The viruses contain the text strings, several of them are in use when the viruses infect the files:
"Ginger.2774,2782":
You can't catch the Gingerbread Man!!
Bad Seed - Made in OZ
COMSPEC= COMMAND.COM
CHKDSK MEM
10/23/92

"Ginger.Orsam.2624":
Orsam - Made in OZ
You can't catch the Gingerbread Man!!
COMMAND

Gippo.901

Description Gippo.901

These are not dangerous encrypted parasitic viruses. They are not memory resident (except "Gippo.1039,1234") and search for .EXE-files and write themselves to the file end.
One month after infection these viruses display the message and leave small memory resident trigger routine which hooks INT 08h and "quakes" the screen. They display the message on installation of TSR trigger routine. See "Gippo.1242,1249" also.
"Gippo.1039,1234" hook INT 08, 21h and write themselves at the end of EXE-files are executed or opened.
"Gippo" viruses display:
"Gippo.901": Fit of hysteria offered by G.I.P.Po.
"Gippo.944": Wake up SUCKER! Gratuitous alarm by G.I.P.Po
"Gippo.1000": Earth is quaking! Public*Domain GIPPo MCMXCIII
"Gippo.1030.a": * SunRise * EpidemicWare G.I.P.Po. oct-93
"Gippo.1030.b": SUNRISE * (C)opyItself 93 GIPPo
"Gippo.1039": !  Bumpy~ (R) Ghost Player
"Gippo.1050": CACOPHONY * EpidemicWare 93 G.I.P.Po.
"Gippo.1234": Stunning Blow (R) Ghost Player Italy
"Gippo.1242": AntiHeuristic GIPPO EpidemicWare
"Gippo.1249": AntiHeuristic GIPPO EpidemicWare (I)

They also contain the internal texts:
"Gippo.901": JumpingJack *.e?e *.* smartc*.cps
"Gippo.944": cacophony *.e?e *.* smartc*.cps
"Gippo.1000": Earthquake *.exe *.* smartchk.cps
"Gippo.1030.a,b": sunrise *.exe *.* smartc*.cp?
"Gippo.1050": Cacofonia *.EXE *.* smartchk.cp?
"Gippo.1242": HAMMER *.exe *.*
"Gippo.1249": HAMMER *.exe *.*

Gippo.1242,1249
This virus manifests itself by video effect.

Home