Virus Database

UVR.3919

Description UVR.3919

It's a dangerous memory resident parasitic virus. On execution of infected file it writes the string
C:UVR.COM

at the beginning of C:AUTOEXEC.BAT file. Then the virus creates C:UVR.COM file and writes itself into there. On execution of that dropper file (i.e. on loading with modified AUTOEXEC.BAT) the virus hooks INT 21h and writes itself at the end of COM-files are executed or opened.
On execution of dropper file under already infected system, the virus displays:
UVR Already installed.

Before infection the virus disinfect the files infected with some parasitic viruses. If some program tries disinfect the file infected with "UVR" virus, it drops "Trivial.59" overwriting virus into the C:PORNO file. The virus deletes the files *.CPS and *._NO on accessing to them. It also creates the file C:C:\__ with two strings inside:
[Note "_" = ASCII 251]
Hai sbagliato!
-U.Vr-

On March, 19th the virus displays:
+-------------------+
¦ Vietato FUMARE! ¦
+-------------------+

then it hooks INT 10h and manifests itself with different video effects: on displaying the text strings it changes the case of characters, changes the cursor characteristics, and so on.
That virus contains the encrypted internal strings also:
- U.Vr, Professional version -
Non riuscirai MAI a sapere tutto quello che sono in grado di fare
MARZO 1993

Check other viruses! Be aware! Use Antiviral Software

Flagyll Family

Description Flagyll Family

These are dangerous memory resident viruses. They hook INT 21h and overwrite .EXE-files that are executed. They contain the internal text strings: "-=[Crypt Newsletter 13]=-", "EXE COM" and
"Flagyll.316,318": Flagyll
"Flagyll.369,371": Flagyll-Z

Flagyll.369.a

Description Flagyll.369.a

This is a dangerous memory resident virus. It hooks INT 21h and overwrites EXE files that are executed. It contains the internal text string:
-=[Crypt Newsletter 13]=-
EXE COM
Flagyll-Z

Home