Virus Database

U.524

Description U.524

It's a dangerous memory resident parasitic virus. It hooks INT 1Ch, 21h and writes itself to the end of .COM-files that are executed. The infected files contain the character 'U' at the fourth byte from the beginning. This byte is the identification byte of this virus. This virus checks the current date and time by using CMOS memory and from May, 7th on 1:57pm it reboots computer.

Check other viruses! Be aware! Use Antiviral Software

Bolero.1000

Description Bolero.1000

These are very dangerous memory resident encrypted parasitic viruses. They hook INT 21h and write themselves to the end of .COM files (except COMMAND.COM) that are executed, opened or accessed with FindFirst/Next DOS functions. The viruses have bugs, and may corrupt the files while infecting them, and infect data files.
The viruses also hook Write DOS function, and depending on the system timer corrupt the files that are saved on disk. The viruses overwrite them with the strings:
"Bolero.1000.a": RAVEL - BOLERO.
"Bolero.1000.b": HANDEL - Carmelite Vesperes.
"Bolero.1254": Divide Overflow
"Bolero.1300": divide overflow
"Bolero.1470": Divide Overflow

Being executed "Bolero.1300" also infects C:DOSFORMAT.COM. When any of the CHKDSK.EXE, SCANDISK.EXE, NDD.EXE programs are executing, this virus does not perform any action with the files.

Bomb.1492

Description Bomb.1492

It's a dangerous memory resident parasitic virus. It leaves itself in system memory together with the infected COMMAND.COM, hooks INT 21h and writes itself at the end of COMMAND.COM files of different drives on execution or opening the files or on DOS command GetDiskSize (AH=36h). Depending on the system time it erases disk sectors and displays the message:
---- C h i n e s e B o m b ----
( Made in China 1989 )

It also contains the internal text strings:
a:command.com B:command.com C:command.com D:command.com command.com

Home