Virus Database

Win95.Vip.4309.a

Description Win95.Vip.4309.a

It is a dangerous nonmemory resident parasitic Win95 virus. It searches and infects PE EXE files in the current directory, then in Windows directory, then in root directories on C: and A: drives, and in random selected subdirectories on C: and A: drives. The virus infects up to two files in each directory on each run. While infecting the virus creates new section with ".TechnoK" name at the end of the file, and writes its code to there.
The virus checks file names and does not infect the files: WININIT.EXE, EXPLORER.EXE, DOSREP.EXE, TASKMON.EXE.
To access Windows functions to search and infect files the virus uses two sets of hard-coded addresses that are valid only under standard Win95 and Win98 editions.
On 12th of any month the virus tries to erase random selected disk sectors, but uses DOS standard of the direct write call, and as a result will definitely cause "General Protection Fault" Windows error message.
The virus contains the text strings:
ViruS "Nèmesi" by / e-ViP (electronic - Virus italian Project)

Check other viruses! Be aware! Use Antiviral Software

Hipp.763

Description Hipp.763

These are harmless memory resident parasitic viruses. They hook INT 21h and write themselves to the end of COM- and EXE-files that are executed. They do not manifest themselves in any way.
"Hipp.763.b" contains the text string:
Hipp

Hippie.a

Description Hippie.a

It is a harmless memory resident stealth boot virus. While loading from an infected disk it hooks INT 1Ch, 2Fh, waits for DOS loading process, hooks INT 13h and releases INT 1Ch. Then the virus infects the disks that are accessed. While loading from any infected disk the virus also infects the MBR of the hard drive. While infecting the MBR the virus uses direct calls to the hard drive ports.
Before installing memory resident the virus reserves a block of the system memory by decreasing the RamSize word at the address 0000:0413. When DOS loads itself into the memory, the virus restores RamSize and stays in the memory as a DOS block.
The virus contains the text strings:
DrW-4
RPL
Dr White - Sweden 1996
Hippie Virus - Written in MalmoallB01F

Home