Virus Database

Win95.Companion

Description Win95.Companion

It is not a dangerous nonmemory resident companion virus. It searches for PE-EXE files (Win95/NT executable files), renames them with COM extension, then copies virus code with EXE extension. As a result of infection there are two files - original file with COM extension and companion file with EXE extension and with the virus body inside.
The virus infects no more than two files in the current directory. Then it executes its host file and returns control. If there are no host file, the virus shows Windows MessageBox and immediately closes it.
To do its work the virus uses standard Win95 routines exported from KERNEL32.DLL and USER32.DLL:
CopyFileA, ExitProcess, FindNextFileA, GetCommandLineA, WinExec,
lstrcpyA, FindFirstFileA, MessageBoxA

The virus also contains the texts:
*.EXE .COM
DeleteFileA

The last string is the name of standard Win95 routine, but it is never called.
Text added: Dec-23-1996

Check other viruses! Be aware! Use Antiviral Software

Saboteur.1391

Description Saboteur.1391

This is a dangerous stealth and polymorphic memory resident parasitic virus. The virus installs its TSR copy to the video memory, hooks INT 21h and writes itself to the end of COM files (except COMMAND.COM) that are accessed.
On the 13th of each month, the virus displays a message, plays some music and erases the CMOS memory. The message is:
This is SABOTEUR-beta version.(c)Black Angel 1995

Sacrilege.1802

Description Sacrilege.1802

This is a benign memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of EXE files that are executed. The virus does not infect anti-viruses TBAV, F-PROT, SCAN, CLEAN and VIRSTOP. When an infected file is executed on March 28th from 10:00 till 13:00, the virus decrypts and displays the following message:
Virus "LA MULA RETOBADA", dedicado a Brocca..(jeje)".Special Greetings to:
Blas Pascal , Mr.S, Krenchas.Fridirik agarrame las bolas, TBAV chupame el
pitongoS&S haceme un pete y dejate de mentir, roba-guitaProfesora de
Liquidacion de Sueldos TIRAME LA GOMAWalter Fabrica sos un PELOTUDO,
LADINO, MENTI((profesionales en sitemas de informacion)) LADRONES..Aguante
" Buenos para Nada " en concierto el 22/9/95 (que bienque toca el
bateroallquien sera????)Y por ultimo un gran saludo a DAVID SQUILLACE. a
real Friend..Ahora si...Feliz cumpleañanos Dr.k, feliz cumpleaños Dr.k,
feliz cumpleaños, feliz cumpleaños, feliz cumpleaños Dr.K Gracias,
gracias....1995 by Dr.K [PVC].

Home