Virus Database

WinScipt.AVM

Description WinScipt.AVM

This is a family of parasitic viruses written in Windows Script language. To replicate themselves they use File System Object (FSO). When run, the viruses locate the host file name, read the file contents, locate their body, search for all .VBS files in the Path directories and write themselves to the end of files. The viruses also scan and infect .VBS files the current directory as well as special directories: Desktop, MyDocuments, Startup.
The viruses also create the AVM.VBS dropper file in the Windows directory and register it in the system registry as the auto-run file. As a result, the virus dropper will be automatically executed by Windows on each rebooting.
The viruses contain the comments:
"AVM.a":

Nick "The Love Monkey" Virus Package by ALT-F4 and ALT-F11
for the Alternative Virus Mafia

"AVM.b":

allby ALT-F4 and ALT-F11 for the Alternative Virus Mafia

Check other viruses! Be aware! Use Antiviral Software

Lifeform.2101

Description Lifeform.2101

It is a very dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM files that are closed (i.e. the virus infects files that are copied, modified or scanned). On debugging or opening an infected file the virus disinfects it (stealth). On accessing infected files length the virus decreases it; when the F-PROT anti-virus or the ARJ, RAR, PKZIP, LHA, BACKUP utilities are run, the virus disables this stealth routine.
The virus also fools the AVPLITE and F-PROT anti-virus programs. When AVPLITE is run, the virus adds the "disable heuristic scanning" to the end of command line. When F-PROT reads data from files to scan them for viruses, the virus fills data buffer with garbage. The virus also deletes the anti-virus data files: ANTI-VIR.DAT, CHKLIST.MS, SMARTCHK.CPS, AVP.CRC, IVB.NTZ, CHKLIST.TAV. Under debugger the virus corrupts the CMOS checksum field and halts the computer. On May 23th the virus erases the data on the hard drive, corrupts the CMOS and displays the message:
-- [LifeForm] coded by ThE_WiZArD (1998) --
Cooler than a body on ice, Hotter than a rollin`dice
Wilder than a drunken fight all You`re gonna burn tonight

The virus also contains the text strings:
#ThE_WiZArD
Quo vadis Fridrik? ... and you Frans still working on this shit.

Light.1010

Description Light.1010

It is a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are accessed or are found by DOS FindFirst/Next DOS functions. The virus has bugs and in some cases corrupts files while infecting them or/and halts the system. The virus contains the text strings:
A long time ago,in very remute institut all
LIGHT in the DARK

Home