Virus Database

Xph Family

Description Xph Family

These are memory resident parasitic viruses. They hook INT 21h and write themselves to the end of COM and EXE files that are executed. They contain the strings: "XPH", "ASCECLHVSRVINWI", "iV". They does not infect the files SCA*.*, CLE*.*, VHS*.*, VIR*.*, WIN*.*
"Xph.1010,1100" depending on its internal counters overwrite the files with the strings:
"Xph.1010": R.A.T. [R]iots [A]gainst [T]echnology -- FIGHT IT BACK !!!
"Xph.1100": -- FIGHT IT BACK !!! R.A.T. [R]iots [A]gainst [T]echnology --
FIGHT IT BACK !!!

"Xph.1943" is a polymorphic virus. Depending on some conditions it erases the hard drive sectors. It contains the strings:
XPH
[C] 08/09/93 by McAfee Associates.
ASCECLHVSPF-ACPRVINWI

Check other viruses! Be aware! Use Antiviral Software

Snow.a

Description Snow.a

It's a not dangerous memory resident stealth boot virus. It hooks INT 10h, 1Ch, 13h and writes itself into the MBR of hard drive and boot sector of the floppy disks. It encrypts the original boot and MBR sectors on infection. Sometimes it calls the video trigger routine that simulates falling snow. It contains the encrypted internal string:
Snow

Sobakin.9592

Description Sobakin.9592

This is a dangerous memory resident {polymorphic:Poly}, {stealth:Stealth} parasitic virus. It hooks INT 21h, and writes itself to the end of COM and EXE files that are accessed. The virus doesn't infect files with names beginning with the following letters:
DR, AV, TB, WE, F-
The virus also restores the original INT 21h address. After infecting 255 files, the virus displays messages in Russian and waits until a key is pressed. After infecting 65,535 files, the virus erases CMOS memory, and erases hard-drive sectors and displays the following message:
Triple L - long live lamer,LMD - lamer must die,
R U ready 4 Hell? No,than say thanx 2:
H(Cr)acker Shtirliz & Cyberpunk Dead One
è â êîíöå ÿ õîòåë áû ñêàçàòü,÷òî êàæäûé íîâûé âèðü õîðîíèò ñ
òàðóøêó DOS,è ýòî ãðóñòíîall.
Is that illusion or reality? Cyber Culture 1998
The virus also contains the text strings:
ã------------------------¬
¦ Pirates Shadow Service ¦
L-------------------------
ViRUS [Feudal] v1.oî
AUTHORS
Dead One & Shtirliz
Feudal ][ coming soon...
Keep CyberSpace Free !
Runtime error 204 at 0000:

Home