Virus Database

Win32.Benny.3219.a

Description Win32.Benny.3219.a

This is a direct action (non-memory resident) parasitic Win32 virus. It searches for PE EXE files in the Windows, Windows system and current directories, then writes itself to the end of the file. The virus has bugs and in many cases corrupts files while infecting them. The virus checks file names and does not infect the files: RUNDLL32.EXE, TD32.EXE, TLINK32.EXE, TASM32.EXE.
While infecting, the virus increases the size of last file section, writes itself to there and modifies the necessary PE header fields including the program start-up address.
The virus contains the "copyright" string:
Win32.Benny (c) 1999 by Benny

Check other viruses! Be aware! Use Antiviral Software

Hellfire.1040

Description Hellfire.1040
These are very dangerous nonmemory resident overwriting viruses, they were published in "Slam #2 E-Zine". The viruses (except "Hellfire.1040,1041.a,b") use simple procedure for encryption virus code. They search for .COM files and overwrite them. The infected files are not recoverable. After infection the viruses display the text:
Bad command or file name

If there are no files for infection or all files are already infected, the viruses display a picture.
This family contains many viruses:
Hellfire.1040
Hellfire.1041.a
Hellfire.1041.b
Hellfire.1085 - encrypted
Hellfire.1086.a - - " -
Hellfire.1086.b - - " -
Hellfire.1089.a - - " -
Hellfire.1089.b - - " -
Hellfire.1091.a - - " -
Hellfire.1091.b - - " -
Hellfire.1091.c - - " -
Hellfire.1091.d - - " -
Hellfire.1099 - - " - set new Int 24h
Hellfire.1101.a - - " - - " -
Hellfire.1101.b - - " - - " -
Hellfire.1122.a - - " - - " - clear and restore file attributes
Hellfire.1122.b - - " - - " - - " -
Hellfire.1123 - - " - - " - - " -
Hellfire.1124.a - - " - - " - - " -
Hellfire.1124.b - - " - - " - - " -
Hellfire.1124.c - - " - - " - - " -
Hellfire.1131 - - " - - " - - " -
Hellfire.1132 - - " - - " - - " -
Hellfire.1133 - - " - - " - - " -
Hellfire.1146 - - " - - " - - " - restore date&time stamp
Hellfire.1147 - - " - - " - - " - - " -
Hellfire.1148 - - " - - " - - " - - " -

text: (c) Michael Egler

Hellis.608

Description Hellis.608

It is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed. The virus contains the text string:
HELL is dedicated to DR.Farmanesh !!! 29/4/95

Home