Chemist.265
Description Chemist.265
It's harmless memory resident parasitic virus. It copies itself into Interrupt Vectors Table, hooks INT 21h and on DOS calls SetDir, SetDist, GetDiskSize it searches for .COM-files and writes itself at their ends. It contains the internal text strings:
*.com
Chemù7t
Check other viruses! Be aware! Use Antiviral Software
AsmVir Family
Description AsmVir Family
These viruses search for .ASM files and overwrite them with virus' hexadecimal dump. While overwriting the viruses add to this dump the assembler instructions that allow to compile and link infected .ASM files:
;~ <- virus ID
casmseg segment
assume cs:casmseg,ds:casmseg,ss:casmseg
org 100h
.radix 10
start:
db all <- virus hex dump
db ...
casmseg ends
end start
Being compiled and linked infected .ASM files can spread the virus.
The viruses also contain the text:
ASMVirus by Qark/VLAD042
AsmVirus
Description AsmVirus
It is a dangerous nonmemory resident overwriting virus. It searches for .ASM files, renames the file with BAK file name extension, then overwrites the .ASM file with the hexadecimal code of the virus that is converted to ASM format. The result of infection looks as follows:
.MODEL TINY
.CODE
ORG 256
a:
DB 0FCh
DB 0B4h
all
< the hexadecimal code of the virus >
...
ENDS
END a
When that file is assembled, the result is a copy of the virus.
The virus contains the internal text strings:
0123456789ABCDEF.MODEL TINY
.CODE
ORG 256
a:
ENDS
END a
h
DB
*.asm bak 0
|