Virus Database

Win16.Vecna.832

Description Win16.Vecna.832

This is a memory resident Windows 3.xx parasitic virus. It infects NE EXE files. While infecting the virus looks for "cave" in file structure: a not used block between end of first file segment and beginning of next one. If there are 152 bytes free, the virus writes its loader to there and modifies the NE header so that this loader takes control when infected file is executed. The virus then saves its complete code to the end of the file without any changes in NE header (as an overlay code).
When an infected file is executed, the loader routine takes control. It reads virus rest code from the end of the file and leaves it in the system memory: it allocates a block of memory and hooks INT 21h by using DPMI calls. The virus then infects NE EXE files that are executed.
The virus does not manifest itself in any way, it contains the text strings:
[BONK] by Vecna/29A (c) 1998
New technology for old header formatsall

Check other viruses! Be aware! Use Antiviral Software

Planters.360

Description Planters.360

It is a dangerous memory resident parasitic virus. It hooks INT 1Ch, 21h and overwrites .COM and .EXE files that are accessed with Get/Set File Attribute (AH=43h) DOS function (DOS command ATTRIB). Depending on its internal counter the virus decrypts and displays the message:
When you think of nuts,
you think of PLANTERS!

Platov Family

Description Platov Family

These are very dangerous memory resident parasitic partly encrypted viruses. They copy themselves to the address 9800:0000h, and hook INT 8, 17h, 21h. While executing the viruses search for COM files of the current directory (except COMMAND.COM) and write themselves to the end of the file.
Depending on the system date the viruses delete the files that are executed, reboot the computer, change the symbols that are printed.
While selecting the A: drive the viruses display the message in Russian "Don't use floppy disks! There may be the viruses!" and erase the floppy disk sectors.
While selecting the GAMES or ANT subdirectories the viruses display the messages in Russian about computer games.
The viruses also contain the text strings:
Access Denied Software presents
The PC Virus
Programmed by Andrey Platov 15 years old on 09.07.1992
Hello to Igan, Pershin
gamesantCOMMAND*.COM

Home