Virus Database

V-Silence Family

Description V-Silence Family

These are dangerous memory resident polymorphic parasitic viruses. Being executed the viruses disinfect the host file, execute it and then infect again. Then the viruses hook INT 21h and write themselves to the beginning of EXE-files that are executed or closed. While opening the infected file the viruses disinfect it. The viruses do not disinfect the file if one of the archive utilities is executing: ARJ.EXE, PKZIP.EXE, AIN.EXE, RAR.EXE, or UC.EXE.
While infecting the viruses encrypt the beginning of the file, save that data to the file end, and then overwrite the file beginning with the virus copy. While disinfection the viruses read the data from the end of the file, decrypt and write it to the file beginning.
The viruses have the bugs, and in some cases they corrupt the files while infecting them.
The viruses delete the files:
C:WINSOL.EXE
C:WINDOWSSOL.EXE
C:WINWIN.COM
C:WINDOWSWIN.COM

The viruses do not affect the files if the file name begins with one of the strings, or if the file is placed in the subdirectory with such name. The strings are:
"V-Silence.4096":
WIN EXCE MSO ACAD MICROG COREL CD PM PAG
"V-Silence.5120":
WIN EXCE RumS MSO ACAD MICROG COREL CD PM DOS

The viruses also contain the internal text strings:
"V-Silence.4096":
1113 Sofia, Acad G.Bontchev str. bl.8 room 104, EUGENE NIKOLOV,
eugene@virbus.bg
Virtual Silenceall written by The Kid,Burgas,Bulgaria 30 December 1995.
Greets to Fridrik Skulason.Without the technical analysis of some viruses
in his F-PROT I would have never written this virus.
Question to Eugene Nikolov:You are the Dark Avenger,aren't you? MtE
"V-Silence.5120":
1113 Sofia, Acad G.Bontchev str. bl.8 room 104, EUGENE NIKOLOV,
eugene@virbus.bg
This is The Virtual Silence virus(LL Cool J alias)...written by The
Kid,Burgas,Bulgaria January'96.
You heard of the new album "Mr.Smith" from LL Cool J,no?It's the best thing
I've ever heard...especially this cool tune "Hey Lover" featuring Boyz II
Men.Go buy the album,you won't regret.
Once a marine,always a marine.
"It does not take a genius to write a virus - any average(!?) assembly
language programmer can easily(?) do it.".Oh,God,forgive them...they don't
know what they are talking about."After all,being a virus-researcher is a
risky job with various side effects - mental disorder for example...You
must be grateful at least a bit to us.We are the guys who make your money.
MtE

Check other viruses! Be aware! Use Antiviral Software

Feliz.658

Description Feliz.658

Feliz.658 is a benign memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of .COM-files that are executed. On the 22nd of December, it decrypts and displays the following message:
Pena que Hitler era incompetente. Feliz Natal, Rapha!

Fellow.1019

Description Fellow.1019

This is a harmless, memory resident infector that hits, in a standard way, .EXE-files that are started. It hooks INT 21h. In September, it displays:
This message is dedicated to
all fellow PC users on Earth
Towards A Better Tomorrow
And A Better Place To Live In

The text "03/03/90 KV KL MAL" present at the end of infected file.

Home