Virus Database

Something.658

Description Something.658

It is a very dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the beginning of COM files that are executed. On the 11th of any month the virus erases the C:AUTOEXEC.BAT file, and writes into it the following commands:
@DEL *.COM
@DEL *.EXE

then it creates the file SOME of zero length. The virus contains the texts:
Something v1.1
some c:autoexec.bat @del *.com @del *.exe

Check other viruses! Be aware! Use Antiviral Software

Tentacle_III.10496

Description Tentacle_III.10496

It is a dangerous memory resident parasitic polymorphic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed or opened. While infecting a file the virus writes to the file EntryPoint the JmpFar_Virus instruction and fixes the EXE relocation table in the same way as "Voronezh.1600" virus does. If an EXE file contains overlay data, the virus moved that data down and writes its code between EXE module and overlay data.
While opening a GIF files the virus depending on its random counter renames them to the name TENTACLE with a random selected extension and overwrites with GIF image of a tentacle.
The virus check the system memory for the memory resident anti-viruses and patches their code, if they are found. The virus also reads some data from IFS$HLP$ and patches it in some way.
The virus contains the text strings:
IFS$HLP$
TBDRVXXXSCANX TBCHKXXXTBMEMXXXTBFILXXXTBDSKXXXTBLOGXXX
WARNING!
Your system is contamined with the Tentacle Virus.
IMPORTANT: Don't open any GIF file!
.GIF.gif.EXE.exeTENTACLE.

Tequila Family

Description Tequila Family

These are memory resident harmless stealth polymorphic multipartite viruses. They write themselves at the end of .EXE-files are executed or closed. These infectors hit MBR on execution of infected files, save the old MBR in the last sectors of C: drive and reduce its size in the Disk Partition Table. The viruses infect RAM on a reboot from the infected MBR only. They hook INT 13h, 1Ch, 21h. According to their internal counters the viruses display a colorful picture (Mandelbrot fractal set) and the message:
Execute: mov ax, FE03 / INT 21. Key to go on!

After executing this instruction the viruses display:
Welcome to T.TEQUILA's latest production.
Contact T.TEQUILA/P.o.Box 543/6312 St'hausen/Switzerland.
Loving thoughts to L.I.N.D.A
BEER and TEQUILA forever !

Tequila.5volt
It's a parasitic (not multipartite) variant of "Tequila" virus. It hooks INT 21h only and does not hit MBR of hard drive. It tries to install itself into UMB. This virus checks the file name and does not hit the files WIN*.*, CHKDSK*.*, BACK*.*. It contains the internal text:
This is a beta version of the '-5 Volt' virus. A final and error free one will never follow because I've got enough of viruses. Now a message to the programmers of Turbo Anti Virus: You do a dangerous play with INT 21h in your TSAFE utility. It took me quite a long time to make the virus compatible with TSAFE. Please use clean programming technics in your next version. Today it's a Saturday and a big party with a lot of TEQUILA takes place! Wow!! Greetings to the U.S. Army in Iraq.

Home