Virus Database

Cheap.828

Description Cheap.828

It is not a dangerous nonmemory resident encrypted parasitic virus. It searches for COM and EXE files, then writes itself to the end of the file. On 4th, 12th, 17th and 25th of any month it 500 times displays the text:
ChEaPeXe v2.0 Virus
by Wâr läDÉ '97 USA

Then all next "generations" of this virus display these messages on any execution - not depending on the system date (bug in the virus?).

Check other viruses! Be aware! Use Antiviral Software

FreddySoft.1663

Description FreddySoft.1663

It's harmless not memory resident encrypted parasitic virus. It searches for COM- and EXE-files (except IBMBIO.COM and IBMDOS.COM) and writes itself to their ends. It contains the internal text string:
FREDDY_SOFT
jln lobilobi blok Q27 Kalibata indah JAKARTA Selatan
Greetings to STACK RIPPER, DOUBLE CLICK, SINGLE DRIVE
COMEXESYSAUTOEXEC.BATIBMBIO.COMIBMDOS.COM

Freedom Family

Description Freedom Family

These are very dangerous memory resident encrypted parasitic viruses. They hook INT 3, 21h and write themselves to the end of COM and EXE files (except COMMAND.* and AIDS*.*) that are accessed with FindFirst/Next DOS functions. The viruses also intercept Write DOS call (AH=40h), and compare the data buffer with the strings in Russian "military", "soldier", "weapon". If these strings are found, the viruses erase hard drive sectors, CMOS, and display the message:
F R E E D O M

"Freedom.3600" also hooks Read functions AH=3Fh and check the data while reading as well as while writing.
The viruses also contain the text strings:
"Freedom.2248":
COMMAND AIDS .EXE .COM
* 1.45/2/01.02.1995

"Freedom.3600":
COMMAND AIDS ADINF WEB .EXE .COM
* 2.15/3/09.05.1995

Under debugger "Freedom.2248" corrupts the data and displays the message in the same way.

Home