Virus Database

Win32.Rhapsody.2602

Description Win32.Rhapsody.2602

This is a harmless non-memory resident parasitic Windows virus. It searches for PE EXE files with .EXE and .SCR file name extensions in Windows, Windows system and current directories, then writes itself to the end of the file.
The virus also infects BAT (DOS batch) files. It writes to there a DEBUG script that contains an image of an infected PE EXE file. When an infected BAT file is run, it runs the DEBUG utility to convert the script back to the PE EXE file form, saves it to a disk and spawns.
The virus contains the following "copyright" strings:
[Win32/BAT.Rhapsody]
(c) 1999 Billy Belcebu/iKX

Check other viruses! Be aware! Use Antiviral Software

Lewd.a

Description Lewd.a

These are not dangerous memory resident parasitic viruses 726, 1656 and 32107 bytes of length. They hook INT 21h and write themselves to the end of EXE files that are executed. While infecting a file they increase its length by VirusLength+[A00h-B00h] bytes. Depending on the system timer the viruses display messages in Russian, some of these messages are up to 2K of length.
"Lewd.b,c" do not infect Russian anti-viruses DRWEB.EXE and AIDSTEST.EXE.
"Lewd.b" contains the text: "1996 by LewD-H". It also hooks INT 9 (keyboard) and depending on keyboard activity halts the computer.
"Lewd.c" also hooks INT 0,8,13h to display the messages. In some cases it drops corrupted self-extracting archive.

LG.a

Description LG.a

It is a dangerous memory resident parasitic virus 1024 bytes of length. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed or closed. The virus contains the text strings:
(c) Light General.
LG

While infecting a file the virus does not write its complete code to the end of the file, but 146 bytes only. The rest of virus code is written to the disk sectors by direct disk-write calls. When an infected file is executed, the virus reads its rest from disk sectors and continues installation. While installing it also looks for some specific code in the system memory and patches it.
While infecting the virus may corrupt disk sectors and disk boot sector. As a result data may be lost, or disk stays as non-bootable.

Home