Virus Database

Win32.Positon.4668

Description Win32.Positon.4668

This is a harmless, per-process memory resident parasitic Win32 virus that is encrypted. It infects Win32 EXE applications (PE EXE files) only. While infecting, the virus creates a new section with the ".Positro" name at the end of the file, and writes itself there.
The virus does not run itself in any way. The virus contains the following text string:
Virus : Win32.Positron_NGVCK Author : Positron
Upon being run, the virus searchs for .EXE files in the current, parent, and Windows directories, and infects PE EXE files in there. Then the virus scans directories on C: drives and infects files in there as well.
The virus then hooks file-access Windows functions and the "Change Directory" function, and returns control to the host program. While the program is active, the virus intercepts the following:
file access: infects .EXE, .CPL, and .SCR files being accessed
changing directory: looks for .EXE files here and infects them.

Check other viruses! Be aware! Use Antiviral Software

Raadioga.1000.a

Description Raadioga.1000.a

It is a dangerous memory resident encrypted parasitic virus. It hooks INT 21h, on DOS calls SetDTA, SetDrive, FindFirst, ChangeDir (these calls are performed when programs are executed, current disk or directory are changed) the virus searches for .EXE files in the current directory and writes itself to the end of the file. The virus does not infect several anti-virus programs (including AVP) according to the string "F-SCTBAVVIVS" - two bytes per name: F-*, SC*, TB*, AV*, VI*, VS*.
On March 10th the virus corrupts the CMOS and displays the message:
HAIGUSTE RAVI KONTROLLITUD VAIKUSE PIMEDUSE JA RAADIOGA

The virus also contains the text strings:
NiL
*.EXE

Rabbit.504

Description Rabbit.504

This is a dangerous, non-memory resident parasitic virus. It searches for COM files, then scans the file for the zero-bytes area 504 bytes in length and, writes itself to there. If there is no such cave, the virus does not infect the file. After infecting each file, the virus displays the file name. The virus has a bug and corrupts some files while infecting them.

Home