Virus Database

YCHV.1080

Description YCHV.1080

It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the beginning of .COM and to the end of .EXE files (except COMMAND.COM and WIN.COM) that are executed. Depending on its counters the virus slows down the computer or decrypts and displays the message:
Your Computer Has Virus! Tel: 0517-3932764 TO 2815

Check other viruses! Be aware! Use Antiviral Software

Harpy.1219

Description Harpy.1219

These are very dangerous memory resident encrypted parasitic viruses. They hook INT 21h and write themselves to the end of .COM and .EXE files that are executed or opened. Depending on the system date the viruses corrupt files instead of infecting them, and display the messages:
"Harpy.1219": Tehran`s Nights. Viruse
"Harpy.1750": This is a Harpy Viruse..

Harrier.4602

Description Harrier.4602

It is not a dangerous memory resident parasitic polymorphic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are accessed. The virus infects the files with the length less than 57K, while infecting EXE files the virus converts them to COM format. The virus also encrypts a random selected block within files while infecting them.
The virus does not infect the files: COMMAND.COM, IBMBIO.COM, IBMDOS.COM. While executing the programs AIDS*.*, WEB*.*, ADINF*.*, DRWEB*.* the virus terminates execution and displays one of the messages:
Program too big to fit in memory
Division by 0
Error in EXE file
Memory allocation error!
Bad command or file name
Cannot load COMMAND.COM . . .
Internal stack overflow!
Incorrect DOS version
This program requires Microsoft Windows.

While infecting a file the virus hooks INT 1, 3 (debugger) and uses these interrupts in its anti-debugging routines. The virus also hooks INT 8 (timer) and on each 256th tick checks CRC sum of its code. In case of wrong CRC sum the virus reboots the computer.
While installing memory resident the virus with probability 1/8 hooks INT 17h and while printing a text replaces it with the message:
Hey, Ugly User, You could be my . . .
I promise You! Death to all CHAINIKS!!!
Cause I am Harrier from DarkLand . . .

If a file is executed with command line starting with "@@", the virus displays the string:
(c) 1996y by TechnoRat "HDL" GenNo:

followed with the number of virus generation.
The virus overwrites the MBR of the hard drive with a program that depending on the system timer displays the message:
I am the ¦ DARKLAND is the
- - +-+ --+ --+ - --+ --+ ¦ kingdom of Hackers
¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦ ¦
+-¦ +-¦ +-+ +-+ ¦ +- +-+ ¦ I come from darkall
¦ ¦ ¦ ¦ ¦++ ¦++ ¦ ¦ ¦++ ¦ I invade Your PC...
- - - - - - - - - --+ - - ¦ I am Your death...
from DARKLAND ¦

The virus also contains the text strings:
.COM.EXECOMMANDIBMBIOIBMDOSAIDSWEBADINFDRWEBALLE:WP
?VirMON-I-Virus has been installed successfully!
?VirMON-W-execution 0 error!
(C)reated by HARD WISDOM!!! (hacker)

Home