Virus Database

SX.749

Description SX.749

This is a benign non memory-resident encrypted parasitic virus. It searches for EXE files, then writes itself to the end of the file.
The virus disables the memory resident anti-virus utilities F-LOCK.EXE, F-XCHK.EXE, and F-DLOCK.EXE. If the virus detects the memory resident TBSCAN anti-virus, it displays the message and returns to DOS:
Too many TSR programs loaded! Out of memory.
On December 1st the virus displays the message:
-THUNDER STRUCK- (c) SX
Written in RSA.

Check other viruses! Be aware! Use Antiviral Software

HTML.NoWarn.a

Description HTML.NoWarn.a

This a family of parasitic HTML infectors. They search for HTML files on the local drive and affect them. The original "NoWarn" virus was written by the same person that wrote the HTML.Internal virus and uses the same way to infect HTML files: the infection routine is a script written in Visual Basic, and the header of infected HTML file contains the reference for this script.
The virus activates its infection routine depending on the system random counter with probability 1/6, it then searches for HTM, HTML and HTT files in the current and parent directories and writes itself to the beginning of the file without any damage for the host file data.
The virus uses a trick to hide the ActiveX warning message: it tries to cover it with its own message window that "inform" the user:
Are you sure you want to view the contents of this HTML document?

This trick works correctly only if the Desktop area is set to 800x600 pixels, otherwise the virus message does not cower the ActiveX warning.
There are several virus versions known. After infecting HTML files they write the text to the browser status line:
"NoWarn.a": HTML.NoWarn v0.1 /1nternal
"NoWarn.b": HTML.NoWarn v0.11 /1nternal
"NoWarn.c": HTML.Guess you shouldn't done that!!! /SwedisHit ADOLF

HtTM.285

Description HtTM.285

These are a harmless memory resident encrypted parasitic viruses. They hook INT 21h and write themselves to the end of COM files that are executed. The viruses do not manifest themselves, they contain the text strings:
this one is unTBSCANable: die you loosy MOTHERFUCKER! [HtTM]
March '94

Home