Wolleh
Description Wolleh
It is not a dangerous memory resident stealth boot virus. It occupies four disk sectors. While loading from infected disk the virus hooks INT 10h, 12h, 13h, 17h, 19h, 1Ch. It then writes itself to boot sectors of floppy disks and C: drive. The code of original sector and the rest of its own code the virus saves to last sectors of drive that is being infected.
Depending on its counters the virus changes digits that are printed (INT 17h). INT 13h hook is used for infection and stealth routines. Other interrupt hooks are used to set and modify internal virus flags and counters. The virus contains the text strings:
? wolleH
Check other viruses! Be aware! Use Antiviral Software
S-Gnome.654
Description S-Gnome.654
It is not a dangerous nonmemory resident encrypted parasitic virus. It searches for .COM files, then writes itself to the end of the file. The virus deletes the anti-virus databases: CHKLIST.MS, CHKLIST.CPS. On April 1st it sets new current date: January 1st 2000. On Fridays 13th it outputs random data to the printer. At 1:30am it displays the message:
REDRUM
WORKING v4.4 -GK-=!AssGnomes!=- 1997
The virus also contains the text:
One ring to rule them allall
S5.1253
Description S5.1253
It is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM files that are executed. It contains the text string: "S5".
|