Virus Database

Win95.Lorez.1766.a

Description Win95.Lorez.1766.a

This virus infects Windows95 PE EXE files (Portable Executable) and KERNEL32.DLL system file. The infection way is similar to "Win95.Yurn": "Win95.Lorez" writes itself to the end of the file and modifies the entry point address in case of executable files, and hooks GetFileAttributesA public routine in KERNEL32.DLL.
The virus has bugs and may corrupt files and halts the system while infecting. The virus contains the text strings:
* [LoRez] v1 by Virogen [NoP] *
KERNEL32.dll
GetTickCount GetWindowsDirectoryA SetFileAttributesA CreateFileA
SetFilePointer ReadFile WriteFile CloseHandle GetSystemDirectoryA
CopyFileA GetFileTime SetFileTime ExitProcess GetFileAttributesA

Check other viruses! Be aware! Use Antiviral Software

RMNS.MW.Woman.353

Description RMNS.MW.Woman.353

This is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM files that are executed.
There are two parts of virus code: Man (RMNS.MW.Man.297) and Woman. Both these parts install themselves into the memory, and infection algorithm is divided into these parts: Man part intercepts execution of COM files, and then passes the control to Woman part that infects the file with Man of Woman code depending on system timer, and the same file cannot be infected with both parts. So the virus can replicate itself only if both parts (Man and Woman) present in memory.
This part contains the text string:
R.M.N.S Test virus R.M.N.S MW Woman

RMS.1472

Description RMS.1472

It is not a dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed or opened. The virus checks the file name and does not infect the anti-virus programs: AVG, CLEAN, GUARD, NOD, SCAN, TBAV, TOOLKIT, FINDVIRU, VSAN. On December 1st the virus displays the message:
Hello !
I'm RMS2 virus. I was born in Slovakia about one year ago.
Don't be worry, I won't format your hdd all :-)
Press any key to continue.

The virus also contains the text strings:
Kurt lives ... somewhere in time.
Zrdavim virusovy radar

Home