Virus Database

Win95.Iced.2112

Description Win95.Iced.2112

This is a benign non memory-resident Win95/98 encrypted parasitic virus. It infects Windows PE EXE files and writes itself to the end of the file. While infecting it increases the size of last file section, writes its body to there and modifies necessary PE header field.
When and infected program starts, the virus takes control and runs its infection routine. To get access to Windows functions the virus scans Windows kernel exported functions by a standard method used by Windows viruses. It then searches for EXE files in current, Windows and Windows system directories and infects first four not infected PE EXE files in each directory.
On June 6th this virus displays the message box:
[Win32.Paradise v1.00]
Late at night i found myself again
wondering and watching TV
I can't believe what's on the screen
something that i wouldn't like to see
Many rare species will perish soon
and we'll be short on food
Why do we have to be so selfish
we have to change our attitude
I know that i am not
the only one that's worried
Why don't we all
wake up, and and realize
Like the birds in the sky
we are flying so high
without making anykind of sacrifice
We've got so little time
to undo this crime
or we'll lose our paradise
It seems to me that there's no sense at all
nobody cares, it's always the same
Mother nature's crying out in pain
I know we are the ones to blame
It also contains the text string:
Paradise [ Stratovarius ] Copyright (c) 1999 by Billy Belcebu/iKX

Check other viruses! Be aware! Use Antiviral Software

Crepate.1944

Description Crepate.1944

This is dangerous memory resident multipartite encrypted virus. On execution of infected file it infects the current drive: boot sector if the current drive is floppy one, and MBR if it is a hard drive. On loading from infected disk the virus hooks INT 1Ch, waits for DOS loading, hooks INT 21h and writes itself at the end of the COM files that are accessed. Depending on the system timer the viruses erase the disk sectors.
The virus contains the following internal text strings:
Crepa R.T. (c) by MI BRACCOBALDO 1992/93 (CREPA)
Italian Virus Laboratory (PISA) Released 3.0 - REDRUM.
Crepa - R.T.

Crepate.2910

Description Crepate.2910

This is dangerous memory resident multipartite encrypted virus. On execution of infected file it infects the current drive: boot sector if the current drive is floppy one, and MBR if it is a hard drive. On loading from infected disk the virus hooks INT 1Ch, waits for DOS loading, hooks INT 21h and writes itself at the end of the COM files that are accessed. Depending on the system timer the viruses erase the disk sectors.
The virus contains the following internal text strings:
COMcomEXEexeOV?ov?
Crepate (c)1992/93-Italy-(Pisa)
Crepa(c) bye R.T.

Home