Virus Database

Turner.3276

Description Turner.3276

This is a very dangerous memory resident polymorphic parasitic virus. While executing an infected program, the virus allocates the EMS memory frame, copies itself to there, and leaves only the INT 21h handler (215 bytes) in the conventional memory. Then the virus traces INT 13h, 21h, and 26h, hooks INT 21h, and returns to the host program.
While accessing to COM and EXE files, the virus maps the EMS frame with its complete copy, and passes control to there. The virus writes itself into the middle of the files at a randomly selected offset: the virus obtains the random offset in the file, moves the block of the original file's code to the file end, and overwrites the file middle with the virus copy. While infecting EXE files, the virus corrects the relocation table if there are entries that overlap the virus code.
In January, the virus erases CMOS, hard drive sectors, and displays the following message:
The Turner Virus Version 3.56
This virus was written in Voronezh in July of 1993
Modified and enhanced with mutant engine & high implantation
In July-November of 1995 by RingWraith
TRY TO CATCH ME IF U RELY K00L!
CMOS allperverted
MBR ...perverted
Whole disk ...wait...

The virus also contains the text strings:
EMMXXXX0
=YooHoo=
SHUTEND

Check other viruses! Be aware! Use Antiviral Software

Form.a

Description Form.a

This is a very dangerous virus. It hits the boot-sector of floppy disks while accessing them and the boot-sector of the hard disk upon rebooting from an infected floppy disk. The virus acts only on the 16th of every month. It processes a dummy cycle when keys are pressed. If you are working with a hard disk, the data could be lost. The virus hooks INT 9 and INT 13h. It contains the following text:
The FORM-Virus sends greetings to everyone who's reading this text.
FORM doesn't destroy data! Don't panic! Fuckings go to Corinne.

Formas.1146

Description Formas.1146

This is a relatively harmless non-memory resident parasitic virus. It searches for .COM-files, then writes itself to the end of the file. On Fridays, the virus "drops" letters on the screen, and then displays:
Ez aztán FORMÅS kis gép !?! ( lett )

Home