Virus Database

Billiard.2658

Description Billiard.2658

It is not a dangerous memory resident partly encrypted parasitic virus. When an infected program is executed, the virus decrypts its encrypted block of code by using INT 1 (tracing) tricks, hooks INT 9 (keyboard) and stays memory resident. On INT 9 calls the virus releases INT 9 and hooks 2Fh. On INT 2Fh calls the virus releases INT 2Fh and hooks INT 9 (as a result at any moment the virus hooks either INT 9 or INT 2Fh).
On INT 2Fh calls the virus also intercepts the INSTALLATION CHECK (AX=AE00h) command that is executed when a copy of COMMAND.COM processor is run, checks the command line, and if command line begins with "DIR" string the virus searches for .COM amd .EXE files and writes itself to the end of the file. While working DIR command the virus temporary hooks INT 21h and "decreases" the length of infected files when they are accessed by FindFirst/Next DOS functions.
On 31st of months the virus manifests itself by a video effect - it runs the symbols on the screen like playing billiard.

Check other viruses! Be aware! Use Antiviral Software

Pulce.1840

Description Pulce.1840

It is not a dangerous memory resident encrypted parasitic virus. It hooks INT 21h. When any file is executed, the virus searches for COM and EXE files of the current directory and writes itself to the end of the file. It does not infect the files from the string:
COMMAND.SCAN.CLEAN.F-PROT.KRNL286.KRNL386.QBASIC.VPIC.

Depending on the system time it also hooks INT 8 (timer) an manifests itself with some video and sound effects, displays the strings:
Hey! C'e' una PULCE nella CPU!!!
PULCE! v2.1 24/4/94 by ALall
Ingegneri d'Ancona succhiate il cazzo e fatemi usare il PC!
Adesso e' ora di fare festa!
BERLUSCONI BOIA!
PULCE! Libera di andare dove vuole

Punisher.1632

Description Punisher.1632

It is a harmless memory resident encrypted parasitic virus. It traces INT 13h, 21h, hooks INT 21h, and then writes itself to the end of COM and EXE files that are accessed. The virus checks the file name, and does not infect the files: A*.*. S*.*, I*.*, C*.*. The virus contains the text string:
The Punisher-I

Home