Virus Database

Wanderer_M Family

Description Wanderer_M Family

These are memory resident parasitic viruses. They hook INT 21h and write themselves to the beginning of COM and to the end of EXE files that are accessed. The viruses check the file names and do not infect several anti-virus programs.
Wanderer_M.1029
It is a harmless virus. It does not infect the files that have 'V' or 'S' letters in their names as well as the files: F-*.*, TB*.*, CL*.*, WC*.*, CO*.*, HW*.*, TK*.*. The virus contains the text string:
Wanderer_M

Wanderer_M.1756 - 1884
These are very dangerous viruses. They delete or corrupt anti-viruses and anti-virus databases, depending on the system time corrupt the disk sectors, display the messages. The viruses detect anti-viruses by using the strings:
HWF-TBCLCO2SWC
CHKLIST.SMARTCHKANTI-VIR

These viruses contain encrypted text strings:
"Wanderer_M.1756":
HA!HA!HA!
*[ The WANDERER.II VIRUS 1995/02/10 ]*
(c) Copyleft 9187-9192 by SVS / KOREA
Shit!! Turbo Vaccine! sibal.. Kaesaekki!

"Wanderer_M.1783":
*[ The WANDERER.II VIRUS 1995/02/21 ]*
(c) Copyleft 9187-9192 by SVS / COREA
Shit!! Vaccine ?! kkak .pet!!!

"Wanderer_M.1809":
*[ The WANDERER.II VIRUS 1995/02/27 ]*
(c) Copyleft 9187-9192 by SVS / COREA
Shit! I hate it.. too..wet!!

"Wanderer_M.1811":
*[ The WANDERER.II VIRUS 1995/03/01 ]*
(c) Copyleft 9187-9192 by SVS / COREA
Kaesibalnom..too..wet!!

"Wanderer_M.1845":
*[ The WANDERER.II (TypeE) VIRUS 1995/03/02 ]*
(c) Copyleft 9187-9192 by SVS / COREA
Ya! Sibalnoma.. Don't excute a Vaccine.
!tcarttA setisoppO

"Wanderer_M.1884":
*[ The WANDERER.II (Type G/Last Version) VIRUS 1995/03/09 ]*
(c) Copyleft 9187-9192 by SVS / COREA
Please, Don't excute a Vaccine.
NEWS FLASH!! SVS WILL NOT MAKE A VIRUSall
BUT SVS IS FOREVER ... GOOD-BYE!!

Check other viruses! Be aware! Use Antiviral Software

Natas.4988

Description Natas.4988

This is a dangerous memory resident multipartite polymorphic virus. It hooks INT 13h, 21h and writes itself into MBR of hard drive, boot sectors of floppy disks and at the end of COM and EXE files that are accessed. It does not infect the files that are opened by PKZIP/PKUNZIP, LHA and ARJ archivators. Depending on its internal counters the virus formats disk sectors. It contains the internal text strings:
BACK MODEM

Yes I know my enemies
They're the teatchers who taught me to fight me
Compromise, conformity, assimilation, submission
Ignorance, hypocrisy, brutality, the elite
All of whitch are American dreams
(c) 1994 by Never-1(Belgium Most Hated)
Sandrine B.

Nautilus family

Description Nautilus family

These are nonmemory resident encrypted parasitic viruses. They search for .COM files, then write themselves to the end of the file.
Nautilus.1712
It is not dangerous virus. It infects files in current directory only. On 1st of any month it displays the message:
Prospero Virus
(C) Opic [CodeBreakers '98]

and then prints the text:
******************PROSPERO!**************************
There is a path to the trancendece of the dollar: Embark
rich beggars! Does magic bring prosperos to his knees?
Reading pretty twilight, making grass uncertain?
Oh,all that christmas snow shouldered by one birthday suit!
The fate of the world under his armpit like a thermometer?
Rejoice Villains! Your time has come.
**************(C) Opic [CodeBreakers,98]*******************

Nautilus.1824
It is not a dangerous polymorphic virus. It searches for files in current directory, then jumps to parent directories, then to DOS, then to WINDOWS, then to WINDOWSCOMMAND directories and infects up to seven .COM files in there.
On November 6 the virus also searches for *.TXT files and writes the text to the end of them:
The year 1866 was made notable by a series of bizarre
events, a chain of mysterious phenomena which have never
been explained, that I am sure no one has forgotten.

Starting from 23:00 the virus displays the message before return to the host program:
Thus ends the voyage under the seas.

The virus also contains the text strings:
*.com *.txt dos windows command ..
[Nautilus]
Sea4, Codebreakers

Home