Virus Database

Win32.Yerg.9412

Description Win32.Yerg.9412

This is a relatively harmless, non-memory, resident, parasitic, encrypted Win32 virus. It searches for Win32 EXE applications (PE EXE files) with .EXE and .SCR file name extensions, then infects them.
Upon being run from the A: drive (floppy disk), the virus looks for victim files in the Windows system directory and in all parent directories.
Upon being run from any other drive, the virus looks for files in the current directory and in all parent directories, then on the A: drive.
While infecting, the virus writes itself to the end of the file.
Payload
On the 18th of any month, the virus displays the following message box:

The virus then changes the mouse cursor image (by dropping the new image to the UFO.ANI file and loading the cursor from there - the new image is UFO-like), and then opens the Web page "http://www.abduct.com" that is dedicated to UFOs.
The virus code also contains the following text strings:
YERG
I LOVE YOU DEE
FORGIVE ME DEE
you make me so happy!
if you see this Dee online in the desc i love you
Cell [MATRiX]

Check other viruses! Be aware! Use Antiviral Software

Beware.442.a

Description Beware.442.a

This is a very dangerous non memory-resident virus. It hits .COM-files by standard way in the current directory. On Monday that falls on the 1st of any month the virus erases some sectors on floppies. It also contains text: "BEWARE ME - 0.01, Copr (c) DarkGraveSoft - Moscow 1990".

BF.677

Description BF.677

It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM files that are executed. While installing the virus also infects the E:COMMAND.COM file, if it exists. The virus also intercepts file opening and cancels attempts to open *.?BF (DBF?) files.

Home