Virus Database

Win95.SV

Description Win95.SV

This is not a dangerous per-process memory resident Windows virus. It affects Windows executable files only (PE EXE). While infecting the virus creates new section at the end of the file, writes its copy to there and modifies necessary fields in the PE header including address of file startup routine. The infection routine has bugs and as a result corrupts some files while infecting them.
When an infected file is executed, the virus scans Windows kernel, gets addresses of necessary Windows functions (file search, read/write, e.t.c.), then sets its find-and-infect routine as handler of system timer with 5 seconds interval, and returns control to the host program. As a result the virus stays in Windows memory as a part of host file's code, the virus find-and-infect routine gets control once per five seconds, then scans directory tree, looks for PE EXE files and infects them. On each call this routine infects up to two files.
The virus creates the C:SV.LOG file and writes its infection report to there (the list of infected files).

Check other viruses! Be aware! Use Antiviral Software

MPS.469

Description MPS.469

These are harmless nonmemory resident parasitic viruses. They search for .COM files of the current directory and write themselves to the end, and Jmp-Virus code (INC AX, JMP Loc_Vir) to the beginning of the file. They do not manifest themselves it any way. The viruses contain the texts:
*.COM
(C) MPS-OPS 1991

MPS.682
It is a memory resident parasitic virus. It hooks INT 21h and writes itself to the end of .EXE files that are executed. It contains the encrypted string:
Przepraszam wszystkich, ktorzy ucierpieli z powodu niedoskonalosci moich
wirusow oraz p.Sella za ich prymitywna budowe. Niestety, dopiero zaczynam
wkraczac w swiat jezyka maszynowego. Marek Pande (C) MPS-OPC v4.01

MPS.754
It is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the end of .COM and .EXE files that are executed. It contains the text:
(C) MPS-OPC v4.12

MPTI.1536.a

Description MPTI.1536.a

It is a dangerous memory resident parasitic partly encrypted virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. Depending on the system date it corrupts the boot sectors and erases CMOS. It contains the text string:
AIDSTESTVL(C) S.A.- MPTI,1992.

Home