Virus Database

VrapExe.3730

Description VrapExe.3730

This is a very dangerous, non memory-resident parasitic virus. It searches for EXE files in the subdirectory tree and writes itself to the end of the files. This virus is a "slow infector" - it searches for files to infect depending on the system time and date and only on even days of the week.
The virus uses semi-polymorphic tricks. The virus code contains many junk "do-nothing" instructions. Before infecting files, the virus scans their code and randomly replace these "do-nothing" instructions with other ones.
In September, the virus erases data on all drives starting from C:. The virus uses anti-debugging tricks. It contains encrypted text strings, but never access them:
<VRAPEXE Programed in Spain>
COMMAND.COM
X:CONFIG.SYS

Check other viruses! Be aware! Use Antiviral Software

Backdoor.WinCE.Brador.a

Description Backdoor.WinCE.Brador.a

Brador.a is a backdoor (a utility allowing for remote administration of the infected machine) for PocketPC based on Windows CE and newer version of Windows Mobile.
It is written in ASM for ARM-processors and is 5632 bytes in size.
After Brador is launched in creates an svchost.exe file in the /Windows/StartUp/ folder, thus gaining full control over the handheld every time it is restarted.

Brador identifies the IP address of the infected handheld and sends it to the virus coder to inform him that the handheld is connected to the Internet and that the backdoor is active. Brador then opens port 2989 and awaits further orders.
The backdoor responds to the following commands:
d - lists the directory contents
f - closes the session
g - uploads a file
m - displays MessageBox
p - downloads a file
r - executes the specified command

Backfont.765

Description Backfont.765

These are memory resident parasitic viruses, they hook INT 21h and write themselves at the end of EXE-files are executed.
Backfont.900,905
These are not dangerous viruses. They hook INT 8 and 21h. They contain no text strings, manifest themselves depending on their internal counters and the current year, month, day and only if EGA-adapter is present. You can see a rather interesting video effect: approximately 20 min after the virus activation all symbols displayed on the screen "flip", i.e. "/," -> "`". (shown approximately). The symbols remain in their places, only their view is changed. Approximately 10 seconds later the original state of the screen will be restored, next 10 sec. later the symbols will flip ones more etc.
Backfont.765,821
These are dangerous viruses. Upon every call of the ChDir DOS function (INT 21h, ah=3Bh) they set one of FAT cluster to BAD (pseudobad cluster).
Backfont.896
It's a harmless virus. It doesn't manifests itself.
Backfont.1172
It's a not dangerous virus. It hooks INT 8, 21h. Sometimes it decrypts and types the message in Russian.

Home