Virus Database

Uranus.2048

Description Uranus.2048

It is a harmless memory resident multipartite virus. It infects COM, EXE, NewEXE (NE) files and disk boot sectors. When an infected file is executed, the virus writes its code to the first hard drive track (unused sectors) and writes its loader to the boot sector of C: drive. The virus then returns to the host program.
When the system is loaded from infected disk, the virus hooks INT 13h, waits for DOS loading process, hooks INT 21h and writes itself to the end of COM, EXE and NewEXE (NE) files that are executed or accessed by FindFirst/Next ASCII DOS calls. When 1.4Mb floppy disks are accessed, the virus infects their boot sectors.
The virus checks the file names - it compares two last letters of file name with pairs of letters of the string:
ANOT86AVVPUSILEDOPNDLPGRPLRKYRRE

and does not infect these files (anti-viruses and utilities SCAN, F-PROT, KRNL386, NAV, AVP, FINDVIRUS, MSMAIL and so on).
The virus also contains the string:
Sailor_Uranus

Check other viruses! Be aware! Use Antiviral Software

Dada_II.786

Description Dada_II.786

It is a harmless memory resident parasitic virus. It hooks INT 21h, 2Fh and writes itself to the end of COM files that are accessed. The virus does not manifest itself in any way. It was named after its "Are You Here?" call INT 2Fh, AX=ABBAh. The memory resident virus code returns AX=DADAh.

Daemaen Family

Description Daemaen Family

These are memory resident encrypted multipartite viruses. They write themselves at the end of COM-, EXE- and SYS-files, the files SC*.*, CL*.*. VS*.*, F-*.* are not infected. On execution of infected program these viruses try to infect MBR sector of hard drive, they save the original MBR sector and its body at the 9/10/11/12 physical sectors of hard drive and then write new infected MBR. These viruses hook INT 13h and infect boot sectors of floppy disks also, the original boot sector and the virus body are stored at the last sectors of floppy. The viruses hook INT 21h also, they hit the files on accessing to them. These viruses look like a harmless ones but during one of experiments one of them erased the FAT of test computer. They contain the internal text strings:
"Daemaen.1894":
COMEXEBINOVLSYSSCCLVSF-
Cowboys From Hell/Vulgar Display of Power [Pantera]
The best Power Metal band in the world.
tHiS k0oL ViRUZ WaReZ bY [TäLöN<=>NûK_] '93!
"Daemaen.2041,2048":
[DäeMåên] by TäLöN-{{NûK_}
Hugs to Sara Gordon
Hey John! If this is bad, wait for [VCL20]!
For Dudley
[VCL20ß]/TäLöN_ï
COMEXEBINOVLSYS

Home