Virus Database

Win95.Gara.917

Description Win95.Gara.917

This is a dangerous Windows9x memory resident parasitic virus. It writes itself to the end of Windows executable files ("Portable Executable" - PE EXE files). When an infected program is executed, it gets control and installs itself into Windows memory: by using a trick it jumps from the application level to Windows kernel, hooks file access Windows functions (IFS API) and stays in the system memory as a VxD driver.
The virus intercepts file opening, filters PE EXE files and infects them. While infecting it increases the size of last file section, writes its code to there and modifies necessary PE header fields.
It contains the "copyright" strings:
[Garaipena by Billy Belcebu/DDT]
On 31st of a month the virus tries to overwrite a block of system memory (VxD drivers area). On some system it will halt the computer, on other Windows will display an error in driver, on some of them the virus will erase video memory data.

Check other viruses! Be aware! Use Antiviral Software

Tadpole.2792

Description Tadpole.2792

This is a relatively harmless memory resident parasitic virus. It hooks INT 21h and 2Fh, and writes itself to the end of COM and EXE files that are executed. Starting from the 28th of any month, this virus also hooks INT 8 and 9, the keyboard is not active for several minutes, and the virus displays a message and launches a draft image of a tadpole running on the screen. The message appears as follows:
PHILIPPINES 2000, Greetings!
This tadpole lurks behind your empty mindall
It wriggles thru your brain just to remind:
You ought to have a sense of real concern
On virus strains that plagued, you've got to learn.
What have you done to clean this dirty world?
Have you taken steps on bogus softwares sold?
What have you done to lethal engineers
Who did create those worms and viral smears?
This tadpole lurks behind your empty mind...
If you've done nothin' you will surely find:
This tadpole leaps out of you brainless fools!
To breed a million more of wriggling--- TADPOLES...
Soon, silicon-based artificial life-forms will rule this organic world...
The creator will disavow any knowledge of my actions.
(Sgd) CCCv (c) Outlawed Technology Section, CCC CompE... Hail U.C.!

Taek

Description Taek

These are not dangerous memory resident encrypted parasitic viruses, "Taek.1846" is polymorphic one. They hook INT 21h and write themselves to the end of COM and EXE files that are executed or opened. "Taek.1965" while installing memory resident also searches for all EXE files in the current directory and infects them.
The viruses check the file names and do not infect the files COMMAND.COM, IO*.*, OS*.*, SC*.*, WI*.*. "Taek.1965" also does not infect F-*.* files.
Starting from 22:00 the viruses display the messages after infecting each file:
"Taek.1846":
Welcome to Scorpion Virus
Copyright (C)

"Taek.1956":
Red Scorpion
Copyright (C) 1995-1996 Taek Software.
Ver Red.1912

Home