Virus Database

Daemaen Family

Description Daemaen Family

These are memory resident encrypted multipartite viruses. They write themselves at the end of COM-, EXE- and SYS-files, the files SC*.*, CL*.*. VS*.*, F-*.* are not infected. On execution of infected program these viruses try to infect MBR sector of hard drive, they save the original MBR sector and its body at the 9/10/11/12 physical sectors of hard drive and then write new infected MBR. These viruses hook INT 13h and infect boot sectors of floppy disks also, the original boot sector and the virus body are stored at the last sectors of floppy. The viruses hook INT 21h also, they hit the files on accessing to them. These viruses look like a harmless ones but during one of experiments one of them erased the FAT of test computer. They contain the internal text strings:
"Daemaen.1894":
COMEXEBINOVLSYSSCCLVSF-
Cowboys From Hell/Vulgar Display of Power [Pantera]
The best Power Metal band in the world.
tHiS k0oL ViRUZ WaReZ bY [TäLöN<=>NûK_] '93!
"Daemaen.2041,2048":
[DäeMåên] by TäLöN-{{NûK_}
Hugs to Sara Gordon
Hey John! If this is bad, wait for [VCL20]!
For Dudley
[VCL20ß]/TäLöN_ï
COMEXEBINOVLSYS

Check other viruses! Be aware! Use Antiviral Software

Sobakin.9592

Description Sobakin.9592

This is a dangerous memory resident {polymorphic:Poly}, {stealth:Stealth} parasitic virus. It hooks INT 21h, and writes itself to the end of COM and EXE files that are accessed. The virus doesn't infect files with names beginning with the following letters:
DR, AV, TB, WE, F-
The virus also restores the original INT 21h address. After infecting 255 files, the virus displays messages in Russian and waits until a key is pressed. After infecting 65,535 files, the virus erases CMOS memory, and erases hard-drive sectors and displays the following message:
Triple L - long live lamer,LMD - lamer must die,
R U ready 4 Hell? No,than say thanx 2:
H(Cr)acker Shtirliz & Cyberpunk Dead One
è â êîíöå ÿ õîòåë áû ñêàçàòü,÷òî êàæäûé íîâûé âèðü õîðîíèò ñ
òàðóøêó DOS,è ýòî ãðóñòíîall.
Is that illusion or reality? Cyber Culture 1998
The virus also contains the text strings:
ã------------------------¬
¦ Pirates Shadow Service ¦
L-------------------------
ViRUS [Feudal] v1.oî
AUTHORS
Dead One & Shtirliz
Feudal ][ coming soon...
Keep CyberSpace Free !
Runtime error 204 at 0000:

Socha.753

Description Socha.753

It is a very dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of .COM files that are opened. The virus activates only if the system date is set to 1981. When any file is executed (except ME$.OVL and NCMAIN.EXE), the virus appends a command line to the file C:M_EDITME$.OVL. The virus contains the strings:
Socha
C:m_editme$.ovl
comCOM

Home