Virus Database

Svir.512

Description Svir.512

This is a harmless nonmemory resident parasitic virus. It searches for .EXE files of the directories that are listed in PATH string, then writes itself to the end of the file. The virus contains the texts: "a:*.*", "*.EXE".

Check other viruses! Be aware! Use Antiviral Software

BillBoard.835

Description BillBoard.835

This is a harmless non memory-resident encrypted parasitic virus. It searches for COM files and writes itself to the beginning of the file. The virus contains the text string:
Billboard 1.0, (c)1993 Slîîzî [Nuke].
Jeff K. - You are a lying prick, just like all politicians
Patty - This was written from the ground up, in Australia
Alan - You are wasting your time chasing Rock Steady
Frisk - Pull your head out of your ass, [NuKE] is way ahead of you AV wankers
Johnny - Scan is just too lame to worry about ha ha

Billiard.2658

Description Billiard.2658

It is not a dangerous memory resident partly encrypted parasitic virus. When an infected program is executed, the virus decrypts its encrypted block of code by using INT 1 (tracing) tricks, hooks INT 9 (keyboard) and stays memory resident. On INT 9 calls the virus releases INT 9 and hooks 2Fh. On INT 2Fh calls the virus releases INT 2Fh and hooks INT 9 (as a result at any moment the virus hooks either INT 9 or INT 2Fh).
On INT 2Fh calls the virus also intercepts the INSTALLATION CHECK (AX=AE00h) command that is executed when a copy of COMMAND.COM processor is run, checks the command line, and if command line begins with "DIR" string the virus searches for .COM amd .EXE files and writes itself to the end of the file. While working DIR command the virus temporary hooks INT 21h and "decreases" the length of infected files when they are accessed by FindFirst/Next DOS functions.
On 31st of months the virus manifests itself by a video effect - it runs the symbols on the screen like playing billiard.

Home