Virus Database

Zorm.643.a

Description Zorm.643.a

These are not dangerous nonmemory resident parasitic encrypted viruses. They searches executable files, then write themselves to the end of the file.
Zorm.643 and 648 infect EXE files only, Zorm.1123 infects both COM and EXE files. Zorm.1123 deletes the antivirus database files:
ANTI-VIR.DAT, CHKLIST.MS, CHKLIST.CPS.
The viruses do not manifest themselves in any other way, they contain the text strings:
"Zorm.643,648": (c)zorm-a,from dr L.
"Zorm.1123": (c)Zorm-b by Dr.L

Zorm.1404
This virus infects COM and EXE files that are executed. On file creating it also creates the file dropper WIN.GPF in the current directory, and appends to the end of the AUTOEXEC.BAT file the instructions that rename this file to A.COM, and execute the A.COM file.
The virus contains the text strings:
KZorm-c01 (c) DrL. From France.July/December 98
I hate holidays,Marie M comes back!
Zorm.1863
---------

It is an encrypted and stealth parasitic virus. It contains the strings:
KZorm-d1.8 (c) DrL. From France.FEB 99
AVP dont forget to send money for what you know!

Check other viruses! Be aware! Use Antiviral Software

BAT.Shadow.1232

Description BAT.Shadow.1232

This is a path companion BAT virus. It does not change batch files but instead creates new batches with the same names as ones further down, so when an infected batch is run from out of a path directory the virus runs first and searches for more batch files to infect them before running the host batch. Delete the hidden batch files from path directories to remove this virus.
This virus infects one batch in each path directory each run by copying a copy of this batch to the same filename but in an earlier path directory. After infecting 35 batch files it displays the message:
ShadowBat 1997

BAT.Sys

Description BAT.Sys

This is a harmless batch virus just 602 bytes of length. It uses "worm" technology to spread: on floppy disks the virus replaces the AUTOEXEC.BAT file and is automatically executed when the system is loaded from such disk, on hard drive the virus replaces SYS.COM file and is executed when DOS is transferred on a new disk.
On loading from infected floppy disk the virus looks for C:WINDOWSCOMMANDSYS.COM file, renames it to SYS.OLD in the same directory, sets Hidden attribute for this file and copies itself to the SYS.BAT file to the same directory.
As a result when a users runs SYS command the virus takes control. The virus then temporary renames SYS.OLD to SYS.COM, executes it, renames it back to SYS.OLD and copies itself to the AUTOEXEC.BAT file on destination disk.

Home