Virus Database

Spb.2061

Description Spb.2061

This is a very dangerous, memory resident encrypted parasitic virus. It hooks INT 21h and 2Fh, and writes itself to the end of EXE files that are accessed. The virus searches and infects EXE files upon change-directory function call. It doesn't infect the following anti-virues:
DRWEB, ADINF, AVP, AVPLITE, ANTI, SCAN
On April 6, June 5, September 8, November 1 and January 10, the virus erases sectors on the first hard drive. It displays the following message:
Hello, guys! This is a test message. I think, you see it, using Norton
DiskEditor. That means you have lost all data on your 1st hard disk. It's
cool!!!! If not, this's suxx. Are you now debugging the program, infected
by this, to make an antivirus ? mmm..

The virus also contains the following text strings:
By VirLab, Jan 2000. SPb, Russia.
Loading program, please waitall

Check other viruses! Be aware! Use Antiviral Software

Heja.511

Description Heja.511

These are not dangerous memory resident parasitic viruses. They hook INT 21h and write themselves to the end of .COM files ("Heja.511" - except COMMAND.COM) that are executed.
Depending on its internal counter "Heja.511" decrypts and displays the message:
(c) 1993 Heja/Adrar.

"Heja.623" contains the encrypted text:
>The 21th Space Explorer< ver 1.35 by HEJA from ADRAR Design.
Ogladajcie nasze nowe demo - nazywa sie FUCK THE OBJECTS.

Helga.666.a

Description Helga.666.a

These are dangerous nonmemory resident encrypted parasitic viruses. They search for COM files, then write themselves to the end of the file. Then the viruses delete the files by using the masks:
*._* *.ms

Depending on the system time the viruses display the messages and halt the computer. "Helga.666.a" displays the message in Russian. "Helga.666.b" displays:
WARNING: ALL DATA ON NON-REMOVABLE DISK
DRIVE C: WILL BE LOST!
Proced with Format (Y/N)?y

The viruses also contain the string:
*.com

"Helga.666.a" also contains the word:
Helga

Home