Win95.Obsolete.1419
Description Win95.Obsolete.1419
It is a dangerous nonmemory resident encrypted parasitic Windows virus. It searches for PE EXE files in the current, Windows and Windows system directories and infects them. While infecting the virus increases the size of last file section and writes its code to there. It also encrypts the original data in last file section. Before return to the host program the virus decrypts it in the memory, and in file these data stays encrypted. This may cause incorrect data processing and errors in the program.
Known virus version is "debug" one, it infects only files with names DUM*, no other files are infected. It also has a bug: it accesses some of necessary Windows functions by addresses that are not valid under all Windows95/98 releases. Under most of Windows version infected files will be terminated by Windows with a standard error message.
Depending on the system timer the virus activates its trigger routine. Infected files with activated routine will displays the message instead of searching and infecting other PE EXE files. The message is:
Win95.Obsolete v1.00
MAN HAS BECOME OBSOLETEall FEAR THE MACHINES!
The virus also contains the text string:
(c) 1998-1999 by T-2000 / Immortal Riot
Check other viruses! Be aware! Use Antiviral Software
Mr_Twister
Description Mr_Twister
It is a harmless nonmemory resident parasitic virus. It searches for .COM files and writes itself to the end of the file. It contains the text string:
Mr. Twister 1994,1
MREI.313
Description MREI.313
It is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM-files that are executed. The virus contains the text string:
(c)KosKon.MREI.v3.93
|