BootCOM.PureText
Description BootCOM.PureText
This is memory resident multipartite virus. It hits COM files as well as system sectors (boot or/and MBR).
On execution of infected file this virus hooks INT 13h, 21h and writes itself at the end of COM-files on their execution or on access to file attributes. On writing on floppy the virus hits boot sector of that floppy. On loading from infected floppy the virus copies itself into video memory, hooks INT 13h, waits for DOS loading and then hooks INT 21h. The master copy of this virus contains the internal words:
PURE
TEXT
Check other viruses! Be aware! Use Antiviral Software
Ghh.482
Description Ghh.482
It's a dangerous memory resident parasitic virus. It hooks INT 1Ch, 21h and writes itself to the beginning of COM-files that are executed. On each timer tick (INT 1Ch) it scans the screen for the "THE GHH" string, and erases the disk sectors if that string is found.
Ghost
Description Ghost
It is a dangerous memory resident boot virus. It infects the MBR of the hard drive and boot sector on floppy disks. While infecting the virus saves the original MBR sector on the hard drive at the address 0/0/8 (track/head/sector) and the original boot sector of floppy disks to the last sector of root directory.
On loading from infected disk the virus copies itself into Interrupt Vectors Table and hooks INT 13h. It then infects floppy disks that are accessed. The hard drive MBR gets infection while loading from infected floppy disk.
While loading from infected floppy disk, if the MBR is already infected, the virus disinfects it: restores the original MBR image and fills sector 0/0/8 with zero byte. While disinfecting the virus leaves its "signature" in the last entry in Disk Partition Table: "GHOST".
The virus uses quite risky anti-debugging trick and as a result halts Pentium computers.
|