Virus Database

Vecna

Description Vecna

It is a very dangerous memory resident multipartite stealth virus. It writes itself to the MBR of the hard drive, to boot sectors of floppy disks and overwrites EXE files on floppy disks. While executing an infected EXE file the virus infects the MBR, decrypts and displays the message and then returns to DOS. The message is:
Out of memory.

While loading from infected disk (HD or floppy) the virus hooks INT 13h, stays memory resident and infects disks and files.
Under debugger and on Pentium computers the virus displays the message:
Vecna Live all

The virus has quite a serious bug - it may continue INT 13h flow with wrong AX register. That may cause damage for disks, including disk formatting.
Vecna.313
It is not a dangerous memory resident stealth multipartite virus. It hooks INT 21h and writes itself to the end of COM files that are executed. The virus writes itself to the MBR sector when an infected COM file is started, it then returns control back to the host file. On loading from the MBR sector the virus hooks INT 13h that then hides virus code in the MBR sector and hooks INT 21h.
Vecna.Outsider
It is a very dangerous memory resident encrypted multipartite virus. It infects .EXE files and boot sector on floppy disks. EXE files get infection in "DirII" virus way. The virus hooks INT 13h, 28h.
In three month after infecting the computer, or under debugger the virus corrupts the CMOS (writes a password?) and displays the message:
[OUTSIDER]
Esta ? minha vingan?a contra esta sociedade injusta
E eu ainda n|o estou satisfeito
Espere e ver|o...

The virus also contains the text strings:
Written by Vecna/SGWW in Brazil 1997

Vecna.Tron
It is a harmless memory resident boot virus. It hooks INT 1, 8, 13h and writes itself to the MBR of the hard drive and boot sectors of floppy disks. The virus contains the text:
[ORGASMATRON] by Vecna/SGWW in Brazil 1997

To hook INT 13h the virus uses i386 debug registers DR0, DR6 and DR7. By using these registers it sets break point on BIOS INT 13h handler. When this handler takes control the processor generates INT 1, and control is passed to virus INT 1 handler. The virus disables debug break point, checks registers and calls its infection and stealth routines in case of need and then returns to original BIOS INT 13h handler. To reset break point and to keep INT 1 hook the virus uses INT 8 hook (timer).

Check other viruses! Be aware! Use Antiviral Software

Deicide.358

Description Deicide.358

These are non-memory resident parasitic infectors. They search for .COM files and write themselves to their beginnings.
Deicide.358 and 359
These are harmless viruses. They contain the internal text string: "Dutch [Breeze] by Glenn Benton".
Deicide.622,623
These are harmless viruses. From the 3rd until the 18th of August, they display the following message:
This Personal Computer has been struck by the uncurable disease that is
called "The Doom of Morgoth".

Deicide.665 and 666
These are dangerous non-memory resident overwriting viruses. When started, they overwrite .COM files of the current directory and type: "File corruption error.". If .COM files are not present, the infector erases the C: disk FAT and types: "Glenn (666) says : BYE BYE HARDDISK!!". They also contain the strings: "DEICIDE!", "Next time be carufull with illegal stuffall...", "*.COM", "This experimental virus was written by Glenn Benton to see if I can make a virus while learning machinecode for 2,5 months. (C) 10-23-1990 by Glenn. I keep on going making virusses.".
Deicide.693
This is a virus. This virus types one of the following messages:
Brotherhood... I am seeking my brothers "DEICIDE" and "MORGOTH"...
Found my brother "MORGOTH"!!!
Found my brother "DEICIDE"!!!
*** Glenn Benton ***

Deicide.1335
This is a non-memory resident, benign virus. It searches for a .COM files and writes itself to their beginnings. This virus types:
As the good times of DEICIDE will be remembered, I started to make a new
virus. You are now facing the dark tombs of "Morgoth". Humble regards to :
Pazuzu Kingu Absu Mummu Tiamat | |
Baxaxaxa Baxaxaxa Yog Sothoth Iak Sakkath | |
Kutulu Humwawa Xaztur | |
Hubbur Shub Niggurath --+--|--+--
|
Also my lovely regards go to Stephanie, the only one who |
makes my heart beat stronger. Want to make love with a --+--
Morbid Angel? Glenn greets ya. |
Press a key to start the program... (This time no damage!).

Deicide.2404, 2405, 2569, and 2570
These benign viruses. After infection, they type one of the following messages, for example:
Cycle sluts from hell
Virus Mania IV
2 Live Crew is fucking cool
Like Commentator I, HIP-HOP sucks
Dr. Ruth is a first-class lady!
Dont be a wimp, be dead!
This dick was made for laying girls.
No virus entry, just me!
Dont bite it, you horny bitch!
Stroke my keys, oh YES!
Sex Revolution 4000
Buck Rogers is fake
(C) by Glenn Benton
Registration number required
The fly is alive
Dont fuck with me, or I will kick some ass...
Hey, dont hit the keys that hard!
You will feel me...
BEER BEER BEER BEER BEER BEER BEER!!!
YOU HAVE A VIRUS, BWAH AH AH EH EH HEH ARF!
I would alter Michael Jacksons face with my fists...
WIM KOK IS STILL A COMMUNIST!
Welcome to COMMENTATOR II
Commentator I & II released!
Legalize ABORTUS!
Ronald McDonald goes Oude-Pekela!
Source code soon aveable...
Dont use a rubber against this virus!
Swimming holiday in Bangladesh!
Neo Nazis are a pile of shit.
Virus researchers are a pile of meat on the street.
World Championship Cat-Throwing
Yo Yo Yo Yo Yo Yo Yo, James Brown is DEAD!
Yech, you are reminding me of my mother-in-law...
How is the weather out there?
Indalis is a fat bitch who looks like a glass-bin.
Lubbers should be castrated for a long time ago.
Legalize hookers (at a low prize!)
Fist fucking sounds irrelevant to you, eh?
I will be Back...
Today it is..... JUDGEMENT DAY!!!
Never mind the dog, beware of owner.
You still owe me a CO-PROCESSOR!
Do not drink and drive
Last name ALMIGHTY, first name DICK
Frodo lives!
The leech lives
Hey, Cracker Jack! Nice virus you made!
A depressive Prince Claus looks like fun!
Happy Eastern
Thank god for AIDS
Art is incredible stupid
Out of semen error
Incorrect BEF version
Of je stopt de stekker erin?!?
Jean Claude van Damme kicks ass.
Cannabis expands the mind
What is this memory? EMS XMS LIM HMA UMB?
NOOOOOO NOT AN IBM SYSTEM, PLEASE!!!!!
Dutch Virus Research Laboratory

Del5th.773

Description Del5th.773

It is a very dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of .COM files that are executed. The virus deletes every 5th file that is opened except *.386, *.COM, *.DLL, *.DRV, *.EXE and *.OV?.

Home