Virus Database

Vigo.1000

Description Vigo.1000

It is a harmless memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of .EXE files that are executed, and on SetFileTime DOS function (AX=5701h). The virus contains the text strings:
*HPK*
E.T.S.I. de TELECO.1992 VIGO
HPK 92

Check other viruses! Be aware! Use Antiviral Software

Int12.818

Description Int12.818

It is a harmless nonmemory resident parasitic virus. It searches for .EXE files and writes itself to the end of the file. Then the virus writes the data of random length to the end of the file, so the file length grows by random value when infected.
The virus gets the address of INT 12h, stores it and sets the INT 21h handles to INT 12h address. While infecting this virus calls to INT 12h instead of INT 21h.

Int13

Description Int13

It is a very dangerous memory resident parasitic stealth virus. It hooks INT 13h, 21h and writes itself to the beginning of COM files that are accessed with FindNext DOS function. The virus uses quite exotic methods of infection that might result in computer failure and lost of files.
While infecting the virus moves 512 bytes of the file beginning to the file end, writes itself to the beginning of the file, and exits infection without increasing the file length. As a result the original header of the file is out of the file's body, but the file is not corrupted.
To fix that problem the virus stores the physical (INT 13h) address of the sector that contains the original file header, and then while reading from the disk (INT 13h) the virus "shows" the sector with not infected file header instead of the real one. This is stealth algorithm at INT 13h level. So, DOS loads infected files as not infected ones when the system is infected with that virus.
To get the address of original file header the virus writes it to the end of the file by INT 21h call, DOS receives that call and translates it to INT 13h format, then the virus intercepts that INT 13h call and stores the values of corresponding registers (i.e. address of that sector).
While writing to the file the virus also uses INT 13h calls, so has not to handle file attributes, time, and write-protect error (INT 24h). The virus contains the string:
Int 13

Home