Virus Database

Trojan.Win32.Erase2002.a

Description Trojan.Win32.Erase2002.a
This Trojan has three separate components: A Windows EXE file 32768 bytes in size, written in C, and containing the code of the other two files: A Windows 9x VXD file 4275 bytes in size, written in assembler A DOS COM file 224 bytes in size, written in assembler (win.com) The Trojan spreads asall

Check other viruses! Be aware! Use Antiviral Software

Krasikov.264.a

Description Krasikov.264.a

It is not a dangerous nonmemory resident parasitic virus. It searches for .COM-files, then writes itself to the end of the file. On 6th of nay month starting from midday the virus decrypts and displays the message:
Destructor, Copyright (C) 1992 by Krasikov

The virus also contains the strings:
KI
*.com

Kreg.1405

Description Kreg.1405

It is a harmless memory resident parasitic polymorphic virus. It hooks INT 10h, 21h and writes itself to the end of COM and EXE files that are executed or renamed. The virus does not infects the files: *CA?.*, *AN?.*, *ES?.*, *WE?.*, *IN?.* (SCAN, COMMAND, AIDSTEST, WEB, ADINF).
While installing the virus uses a trick that hides the virus on the memory map: the virus copies its INT 21h handler (49 bytes) to BIOS data area at address 0000:04D0, sets INT 21h to there and hooks INT 10h. When any program calls DOS function (INT 21h), the virus compares it with Execute and Rename functions (4Bh, 56h) and calls INT 10h with AX=DEADh. This is an "infect-it" call, and virus INT 10h handler intercepts it and infects a file.
The virus contains the text strings:
[ Gremlin 1.04 / AVL ]
[ KREG 1.01 / AVL !

Home