Virus Database

V.1526

Description V.1526

It is a harmless memory resident multipartite virus. When an infected file is executed, it hooks INT 21h, infects the MBR of the hard drive and stays memory resident. When the system is loading from infected MBR, the virus hooks INT 1Ch, waits for DOS loading procedure and then hooks INT 21h.
When a .COM or .EXE file is executed, the virus writes itself to the end of the file. When the DOS command GetDiskSpace is executed, the virus searches for executable files and infects them.
The virus does not manifest itself in any way.

Check other viruses! Be aware! Use Antiviral Software

Ghost.1447

Description Ghost.1447

It is a dangerous memory resident virus. It infects COM- and EXE-files when they are executed or opened. Before infection the infector appends to file random times of NOP (90h) instructions:
+-----------+
¦File ¦
+-----------¦
¦90h 90h all¦
+-----------¦
¦Virus ¦
+-----------+

The infector works only under DOS 3.30 because it uses some undocumented system areas and addresses of DOS 3.30: one part of the code the virus copies into one system buffer (I don't understand for why). It contains the text "MINSK GHOST,1991" and hooks INT 1Ah, 21h.

Ghost_2.5000

Description Ghost_2.5000

This is a very dangerous memory resident encrypted parasitic stealth-virus. It hooks INT 21h and 25h, and writes itself to the beginning of COM- and EXE-files that are executed, opened or closed. If the resulting COM-file length is out of segment (64K), the virus converts the file to EXE format.
While installing its TSR copy, if there is no free system memory, the virus displays the following message, and exits to DOS:
Swap file creation error at 0FAD:2DEC.
Program aborted.

The virus contains code that overwrites .PAS- and .CPP-files with the following text:
There is nothing in the world that I ever wanted more than to never feel
breaking apart all my programs again. The spiderman is always hungry

but this code is never executed.
In January, the virus corrupts the data on the hard drive, and then displays the following message (there may be any random digit instead of "000000000"), and "drops snow" on the screen:
Happy New Year !
Ghost 1.0 is terminating its work now. Please waitall
Write down this number : 0000000000 and pray for your data rescue.

The virus also contains the internal text strings:
COMMAND.COM
.COM.EXE.PAS.CPP
I feel so tired.
The way the rain comes down how it`s how I feel inside.
I`ve been living so long with my pictures of you
Remembering you standing quiet in the rain

Home