Virus Database

Choleepa

Description Choleepa

Lots of users are worried about the text string "CHOLEEPA" appearing on the second sector (0/0/2 - track/head/sector) on their hard drives. After long investigation, we've found a reason. This is neither a virus nor a Trojan horse, but just a joke - the string is dropped by some software (EZ driver?) that is distributed with Seagate hard drives (over 500M). These disks have the text string being "pre-installed" on the second physical sector.

Check other viruses! Be aware! Use Antiviral Software

Deliver.BlueShark.1771

Description Deliver.BlueShark.1771

This is a dangerous memory resident encrypted parasitic viruses. It hooks INT 21h and writes itself at the end of EXE-files are accessed. On November, 1st it overwrites the hard drive sectors with the strings:
! MAYBE ONE DAY WE BE UNITED !
then it plays the tune, displays the US national flag and the message:
!!! MY NAME IS DISKDELIVER * THIS IS ONLY BEGIN * I BE BACK !!!
It also contains the internal string:
""" CREATED BY BLUE SHARK - FINISHED 7.VIII.1994 15:30 - CIESZYN POLAND """

Deliver.Digi.3547

Description Deliver.Digi.3547

This is a polymorphic stealth virus. It hooks INT 1, 3, 1Ch, 21h and writes itself to the end of COM- and EXE-files that are executed. While creating, opening and executing COM- and EXE-files it stores their names, and hits them on the files closing. On opening of infected files the virus disinfects them. On FindFirst/Next DOS calls it "decreases" the infected file length. The virus deletes CHKLIST.* files, while execution of CHKDSK utility it disables its FindFirst/Next handler, while execution of MKS anti-virus scanner is stops the infection. It disables the debugging of the virus code by hooking INT 1, 3.
On May, from 28th till 31th the virus overwrites the hard drive sectors with the strings:
DIGI POWER
Then it manifests itself with the video and sound effects, and displays the message:
DIGI POWER
THIS IS A NEW all
DELIVER II SÆëâlÆH (R) WRITE BY DiGiT! ... SOUTH POLAND 1995

Home