Virus Database

Win95.Lizard.1967

Description Win95.Lizard.1967

It is a very dangerous Win95/DOS virus. It infects DOS EXE files and creates VxD (Win95) droppers, it is encrypted in DOS EXE files. Depending on the system timer the virus erases EXE files instead of infecting them. The virus was named after the text string found inside of virus code:
Lizard by Reptile

When an infected DOS EXE file is executed, the virus creates its dropper in one of Windows directories:
c:windowssystemiosubsyslizard.vxd
c:win95systemiosubsyslizard.vxd
c:windows.000systemiosubsyslizard.vxd

If there are no such directories, the virus returns to the host program without any harm to the system. Otherwise Windows95 gets a virus dropper - VxD (EXE LE) file in auto-run directory SYSTEMIOSUBSYS
When Windows is loading, it runs all VxD drivers from its auto-run directories. As a result the virus takes control and installs itself into the system (memory resident). It hooks Interrupt 21h V86 chain and intercepts five calls: Execute, Create, Open, Close and FindFirst. On any of these calls the virus searches for DOS EXE files in the current directory and writes itself to the end of the file.

Check other viruses! Be aware! Use Antiviral Software

P2P-Worm.Win32.Krepper.c

Description P2P-Worm.Win32.Krepper.c
This virus is written in C, and is a Windows PE EXE file, approximately 17KB in size, packed using UPX. The unpacked file is approximately 45KB in size. On launch, the worm checks the victim machine for VMWare. If it is launched under VMWare, some of the malicious functions will not beall

P2P-Worm.Win32.Tibick.f

Description P2P-Worm.Win32.Tibick.f
This worm spreads via file-sharing networks. The worm itself is a Windows file approximately 14KB in size, packed using UPX. The unpacked file is approximately 35KB in size. Installation Once launched, the worm copies itself to the Windows system directory as 'svcnet.exe':all

Home