Virus Database

Win95.Zom.864

Description Win95.Zom.864

This is a harmless, memory-resident parasitic virus. It replicates under Win9x systems only. The virus stays in Windows memory as a VxD driver, hooks file operations (IFS), and then infects PE EXE files that are being opened, re-named or searched by name.
While infecting a file, the virus writes itself to "cave" at the end of the first file section if it exists (long enough data filled with zeros). As a result, the file length doesn't grow during infection.
The virus does not manifest itself in any way. The virus contains the following "copyright" text:
Z0MBiE-4.1

Check other viruses! Be aware! Use Antiviral Software

FishN6.a

Description FishN6.a

This is an encoded memory-resident very dangerous virus that hits COM and EXE files by standard way upon their execution and closing. In infected files it increases the year of last modification by 100. The virus supports practically all functions of a stealth-virus. FishN6 encodes its own body not only in files, but also in its TSR copy (on entering the system the virus decodes itself through the INT 21h chain, on exiting - it encodes itself).
Since 1991 FishN6 hangs up the system reporting the following:
FISH VIRUS #6 - EACH DIFF - BONN 2/90
Apart from this string, it contains the following lines:
COD
SHARK
CARP
BASS
TROUT
MUSKYZ
SOLE
PIKE
MACKEREL
FISH
TUNA
FISH FI
The virus hooks INT 13 and INT 21h.
If the number of current day is equal to the number of current month then this virus erases the disk C: sectors. This infector contains the internal text strings:
Don't trouble trouble until trouble troubles you.
(c)Fly

Fist Family

Description Fist Family

These are harmless encrypted parasitic viruses. They write themselves to the end of the file.
Fist.403,625
These are nonmemory resident viruses. They search for .COM files of current directory, and infect them. They contain the texts:
"Fist.403": *.COM Screaming Fist (c)1
"Fist.625": *.COM Screaming Fist (c)10/91

Fist.683
It is a memory resident not encrypted virus. It hooks INT 21h and infects .COM files that are accessed. It contains the text string:
Screaming Fist (c)10/91 C:COMMAND.COM COMSPEC=

Fist.692,696,711,732,838,855,862, Fist.Stranger
These are memory resident viruses. "Stranger.709.b" is not encrypted. They hook INT 21h and infect COM and EXE files including COMMAND.COM. They contain the texts:
"Fist.696,732": C:COMMAND.COM Screaming Fist II
"Fist.692,711": Screaming FistC:COMMAND.COM
"Fist.855,862": Screaming Fist IIC:COMMAND.COM
"Stranger.709.a": I am a stranger in a strange landall
"Stranger.709.b": I am a Stranger in KOREA ...

Home