Virus Database

Zyx.5685

Description Zyx.5685

It is a very dangerous nonmemory resident encrypted parasitic virus. Being executed the virus performs several actions to avoid detection by antivirus software. It checks the interrupts vectors to detect the memory resident antivirus monitors, reads and checks the CONFIG.SYS file to detect installed antivirus software. Then the virus searches for COM and EXE files and writes itself to the end of the file.
The virus manifest itself in several ways. It corrupts the anti-virus data files, deletes the files, writes to the beginning of .C, .PAS, .TXT, .ME, .DOC, .BAK and .ASM the message:
To Karen
In the realm of a greek deity, I dreamt of you.
A weird reverie,
Typewriters were like clouds, high in the sky,
The floor was made of paper,
Pencils stood for trees,
A light bulb, low on the horizon, made a perfect sunset.
And it rained words all
Then you came, more beautiful than ever,
The only one real in my cyberspace.
I felt like holding you im my arms, touching your hair,
Telling you how much I loved you,
How much I wanted to lose myself in your pretty brown eyes.
I was almost in heaven.
Suddenly it was pitch dark,
The greek god had turned off the PC. It said:
'Buddy you're just a damned cyberpunk
whose only friends are NPCs.'
I opened my eyes, it was dawning outside.
You weren't there.
I miss you. I really miss you.
Zyx
From the slums of
Beverly Hills.

The virus also contains the text strings:
I'MWackOkiDtHebRainChildOfZyx
Stopsnoopingintomywork
Itoldyoutostop
Ifyuwanagoontakesomeflowerstoyourgirltoday&makeherhappyok
*.*
IhateturksazerbaijanisandKARABAGHbelongstous
ME M
*.COM *.EXE
SCANVAL.VAL FSIZES.QCV
SCAN.EXE NAV.EXE TBSCAN.EXE STACKER.COM
COMMAND
CONFIG.SYS
NAV_.NAV&.EM
CHKVIRUS.CFG
NAV_*.*
CHKLIST.MS
VSAFE.
*._XE *._OM
SIGNTURE.DAT
.. OMSPEC=
PAS DOC CHKLIST.CPS
BAK ASM
C TXT
Sowhatdidyougainwiseass
wishIhaddonesomethingelse

Check other viruses! Be aware! Use Antiviral Software

Linux.Winter

Description Linux.Winter

This is a harmless non-memory resident parasitic Linux virus. It is extremely small in size for a Linux virus - just 341 bytes (in the known virus version).
When an infected file is run, the virus gains control, searches for ELF files (Linux executable files) in the current directory, then writes itself to the middle of the file to the non-used "Notes section" if there is one and it has enough size. While infecting, the virus overwrites "Notes" data in the section, but the program runs properly after that.
The virus contains the text string:
LoTek by Wintermute
The virus has a routine that sets a host name (computer name) to "Wintermute", but this routine never gains control.

Linux.Zipworm

Description Linux.Zipworm

It is harmless Linux virus affecting ZIP archives.
When the virus is run, it looks for ZIP archives in current directory and add its copies to there. While infecting the virus does not use any external ZIP processing tool, but parses ZIP internal formats by itself. The virus files in archives have one of five possible names:
Ten motives why linux sux!
Why Windows is superior to Linux!
Is Linux for you? Never!
Is Linux immune to virus? NO!
zipworm!
The virus also contains the "copyright" text:
elf zip worm vecna

Home