Warlock Family
Description Warlock Family
These are dangerous memory resident parasitic viruses. "Warlock.1817" is encrypted. They are modifications of "Yankee" virus. "Warlock" virus trace INT 13h, 21h ("Warlock.1817" also traces INT 2Ah), hook INT 21h and infect COM and EXE files (except COMMAND.COM) that are accessed. The viruses write themselves to the end of the files.
In some cases the viruses corrupt .DBF files. The viruses contain the text strings:
"Warlock.1676":
WARLOCK
.COM .EXE .OVL .DBF
"Warlock.1817"
Revenge of WARLOCK!
COMMAND.COM EXE OVL DBF
Check other viruses! Be aware! Use Antiviral Software
Gdynia.680
Description Gdynia.680
Gdynia.680 is a benign non-memory resident parasitic virus. It searches for COM files, then writes itself to the end of the file. Starting from February, the virus decrypts and displays the following message:
Windows 95 may be dangerous.
OS/2 is the best operating system!
I`ll prove it soonall
If this text is modified, the virus reboots the system. The virus also contains the text strings:
*.COM
* Gdynia 1996 * v1.0 *
Geek.450
Description Geek.450
It's a very dangerous memory resident parasitic virus. On execution it copies itself into the Interrupt Vector Table and hooks INT 21h. Then it hits COM- and EXE-files that are executed. On the 29th of every month it erases the disk sectors with a random selected number. It contains the internal text strings: "v07a", "GEEK", "dex".
|