Virus Database

Bolero.1000

Description Bolero.1000

These are very dangerous memory resident encrypted parasitic viruses. They hook INT 21h and write themselves to the end of .COM files (except COMMAND.COM) that are executed, opened or accessed with FindFirst/Next DOS functions. The viruses have bugs, and may corrupt the files while infecting them, and infect data files.
The viruses also hook Write DOS function, and depending on the system timer corrupt the files that are saved on disk. The viruses overwrite them with the strings:
"Bolero.1000.a": RAVEL - BOLERO.
"Bolero.1000.b": HANDEL - Carmelite Vesperes.
"Bolero.1254": Divide Overflow
"Bolero.1300": divide overflow
"Bolero.1470": Divide Overflow

Being executed "Bolero.1300" also infects C:DOSFORMAT.COM. When any of the CHKDSK.EXE, SCANDISK.EXE, NDD.EXE programs are executing, this virus does not perform any action with the files.

Check other viruses! Be aware! Use Antiviral Software

Konkoor.1933

Description Konkoor.1933

This is a dangerous memory resident parasitic virus. While executing an infected program, this virus searches for the DOS address in the INT 21h handler, then searches for COM files, and hits them. Then the virus hooks INT 21h, and intercepts the FindFirst function (AH=4Eh). During calls to that function, the virus searches and infects COM files and also upon the execution of an infected program. While infecting, the virus writes itself to the beginning of the files, and encrypts the host file. On the 100th infection, or depending on the system date, it erases CMOS and hard drive sectors, and displays the following messages:
Warning !!! KONKOOR Must be destroyed !
Sig: -= The Real Computer Scientists =-
and
KONKOOR V1.60 -- Date: 10 MARCH 1994
While installing, it also displays the message:
Bad command or file name

Konkoor.3072

Description Konkoor.3072

This is a very dangerous memory resident parasitic virus. It hooks INT 21h, intercepts the DOS function ChangeDir (AH=3Bh), and when that function is executed, the virus searches for EXE-files, and writes itself to the middle of the file. The virus has a memory allocation error, and may halt the system while infecting the files. The virus checks the file names for the text string, and does not infect these files:
SCAN
CLEAN
VSHIELD
FINDVIRU
FV386
FV86
CLEANBOO
VIVERIFY
CERT
MSAV
GUARD
TDUMP
Under DOS 4.x or earlier, the virus displays the following message, and returns to DOS:
Incorrect DOS version
On the 13th of any month, the virus overwrites the hard-drive MBR with a trigger program. While booting from this MBR, the program displays the following message:
Konkoor v2.0 - Crack Master - Last Days Of 1995
What Was The First Iranian Virus ?
1. Abbas ??? (Was it Iranian ?)
2. Roohi
3. TDD - Konkoor v1.0
4. None Of Above
-= This is The Last One If You Solve Copyright Problem =-
Choose the correct answerall
waits for key '3', and continues booting.

Home