Virus Database

Cara.1024

Description Cara.1024

It is a harmless memory resident virus that affect .COM-files while DOS access to them. It contains some function against some other viruses:
if memory size is not divided to 10h then the virus type: "Virus es en memoria!";
if some disk sectors contain the Boot-virus signature "Cara.1024" writes into these sectors small program which type while booting: "Disco es infectado. Reemplaza "Boot". Clandestino Auto- Reproductivo Anti-virus".
The infector contains the text "CARA" and hooks INT 13h, 20h, 21h.

Check other viruses! Be aware! Use Antiviral Software

Caesar

Description Caesar

This is a harmless, non-memory resident encrypted parasitic DOS virus. It infects DOS EXE files and creates its "dropper" in the C:WINDOWS directory.
When an infected file is run, the virus creates the infected CAESAR.EXE file (virus dropper) in the C:WINDOWS directory and overwrites the WINSTART.BAT file with an instruction that will run the virus dropper. As a result, virus dropper is activated each time Windows is started up. The virus then returns control to the host program and does not infect any other files.
When the virus dropper takes control, it searches for *.EXE files on all drives and infects them. While infecting, it writes itself to the end of the file. The virus checks file names and avoids infecting the following files:
AN*, AD*, DR*, PR*, NC*, WI*
Because of its method of infection, the virus is functional only when Windows is installed exactly in the C:WINDOWS directory.

Cagliari family

Description Cagliari family

These are very dangerous memory resident parasitic viruses. They hook INT 21h and write themselves to the end of .COM files that are executed. On May 1st they erase the FAT sectors on disks A, B, C, D and then display the message:
caGLiArI

The similar string is used by virus in its "Are you here?" call - while installing the virus calls INT 21h with AX=FFABh, the memory resident copy returns 'CA', 'GL', 'IA', 'RI' in registers AX,BX,CX,DX.

Home