Virus Database

Trojan.PSW.M2.14.a

Description Trojan.PSW.M2.14.a

This family of Trojan horses is capable of stealing various passwords. Trojans have a program "configurer" (configuration component) that allows malefactors controlling these viruses to adjust server components as they desire.
All trojans work the same way - after OS re-start they copy themselves to the %WinDir% directory, or to the directory %WinDir%System (depending on the given instructions) and then they register themselves in the system registry.
While operating trojans search disks for files containing passwords for Windows, EDialer, WinCommander, and also can read out a configuration for modem adjustments. In a set time interval they (Trojans) send all collected information to a specified e-mail address.
PSW.M2-family Trojans have an auto-updating function.
Configuration component screen shots - the text displayed is partially in Russian:

Check other viruses! Be aware! Use Antiviral Software

Epa.867

Description Epa.867

This is a dangerous memory resident parasitic virus. It hooks INT 1Ch and 21h, and writes itself to the end of EXE files that are opened. If the current time is 39 min 1 second, the virus decrypts and displays the strings:
EPA POLLUTION PREVENTER V1.0 PRESS "POWER" KEY TO CONTINUE

Epsilon Family

Description Epsilon Family

These are dangerous memory resident companion viruses. They hook INT 21h and create companion .COM files for .EXE files that are executed.
The "Epsilon.513" virus has bugs and in some cases halts the system. This virus contains the text string:
<Epsilon 1.0 (C) 15.3.1995 B.T.Pir8>

"Epsilon.1498" intercepts GetVector DOS function, and when some program gets INT 21h vector's address, the virus restores the original INT 21h address, waits for 64 keystrokes and then re-hooks INT 21h again. To do that the virus also hooks INT 16h.
This virus does not keep its complete code and data in the memory, but stores the name of the infected file. While infecting an EXE file the virus reads its complete code from that file and writes it to the companion COM file.
Depending on its random counters the virus overwrites the disk sectors with the strings:
<Epsilon 1.9 (C) 27.4.1995 B.T.Pir8 * This virus was written in the city of
Brno, Czechoslovakia (4Ever!), Europe (No such bloody America !). Drink
only Tuzemsky Rum and fuck only Slovak girls ! * A word to AEC, especially
BBS Sysop and Mrnustik & comp. : You are bloody fucked idiots ! I'l destroy
your dirty sickening BBS. Get ready, stupid idiotic lunatics ! Get ready
for WAR !!! * Message to Grisoft : Your AVG 3.3 is nice but not very
succesfull on Epsilon, I'm afraid.>

Home