Virus Database

Worm.Ternop

Description Worm.Ternop

This is a worm virus spreading under DOS. The worm file itself is an encrypted 2.5Kb DOS COM program. When it runs, it copies itself into WindowsCOMMAND directory with a random 8-bytes name, for example:
QNLKKLNQ.COM
JIIJLOSK.COM
YPETEDUM.COM

The worm affects the Windows directory wherever it is placed - the worm tries all variants from C:WINDOWS till Z:WINDOWS.
The worm then modifies the SYS.COM file (copy system files to target drive) so that the worm copies itself to the disks that are SYS-ed. To do that the worm renames the SYS.COM file with the SYS.OLD name and creates a companion SYS.BAT file that contains a set of Batch instructions. These instructions when activated rename to COM and run the original SYS.COM file, and then copy the worm code to target drive.
The worm then looks for RAR archives in the directory tree on the current drive, and adds its copy to their contents. The next victim of the worm is the Maximum BBS, if it is installed on the computer. The worm scans the drive directories for FILES.BBS files, and creates its copies in such directories. The worm then "registers" its copy in the FILES.BBS file - adds a reference to its file and a short description in Russian, like "From 2xx to 300MMX", "New Internet cracker", "Speed-ups modem by 30%", e.t.c.
The worm does not manifest itself in any way, it contains the texts:
Ternopil Worm
Misdirected Youth

Check other viruses! Be aware! Use Antiviral Software

MusicBug

Description MusicBug

This is like a Brain Boot infector. It contains the text "MusicBug Made in Taiwan". Whenever disks are accessed the virus tunes some melodies. It also hooks INT 13h.

MustDie family

Description MustDie family

These are harmless memory resident parasitic viruses, "MustDie.1253,1473" are encrypted. They hook INT 21h and write themselves to the end of COM and EXE files that are executed, renamed or accessed by Get/Set Attributes DOS call. The viruses do not manifest themselves in any way, they contain the encrypted text "COMEXE" and strings (partly in cyrillic):
"MustDie.1207":
MUSTDIE v.1 (a) <É«úá¡«ó à.Ç. must die> îâêô(C)1996-97
"MustDie.1253":
MUSTDIE v.2 (a) <USERS of the wold must die> îâêô(C)1996-97
"MustDie.1473":
MUSTDIE v.3 (a) <RAP&POPS must die, GABBER forever !> îâêô(C)1996-97

Home