Virus Database

Daemaen Family

Description Daemaen Family

These are memory resident encrypted multipartite viruses. They write themselves at the end of COM-, EXE- and SYS-files, the files SC*.*, CL*.*. VS*.*, F-*.* are not infected. On execution of infected program these viruses try to infect MBR sector of hard drive, they save the original MBR sector and its body at the 9/10/11/12 physical sectors of hard drive and then write new infected MBR. These viruses hook INT 13h and infect boot sectors of floppy disks also, the original boot sector and the virus body are stored at the last sectors of floppy. The viruses hook INT 21h also, they hit the files on accessing to them. These viruses look like a harmless ones but during one of experiments one of them erased the FAT of test computer. They contain the internal text strings:
"Daemaen.1894":
COMEXEBINOVLSYSSCCLVSF-
Cowboys From Hell/Vulgar Display of Power [Pantera]
The best Power Metal band in the world.
tHiS k0oL ViRUZ WaReZ bY [TäLöN<=>NûK_] '93!
"Daemaen.2041,2048":
[DäeMåên] by TäLöN-{{NûK_}
Hugs to Sara Gordon
Hey John! If this is bad, wait for [VCL20]!
For Dudley
[VCL20ß]/TäLöN_ï
COMEXEBINOVLSYS

Check other viruses! Be aware! Use Antiviral Software

Cordobes.3294

Description Cordobes.3294

These are dangerous memory resident parasitic polymorphic viruses. They hook INT 21h, intercept FindFirst/Next ASCII calls (AH=4Eh,4Fh) and write themselves to the end of EXE files that are accessed. The viruses delete the CHKLIST.MS file. In four month after infection the viruses append to the end of the C:AUTOEXEC.BAT file the commands:
@Echo Virus "EL MOSTRO CORDOBES".
@Echo No tema por sus datos. Que pase un buen día.
@Echo.
@Pause

CorporateLife.1937

Description CorporateLife.1937

These are not dangerous memory resident parasitic polymorphic viruses. They hook INT 21h and write themselves to the end of EXE files on DOS calls FindFirst/Next FCB. During infection they use old FCB calls. The viruses have bugs and may corrupt the files while infecting them. If there is a sound blaster installed with the Speech driver, the viruses pass to the driver the string to speak it:
"CorporateLife.1929,1937": Fuck Corporat Life.
"CorporateLife.1931,1935,1939,1943,1947,1951,1957,1961,1971":
Mini Cat

The viruses also contain the text strings:
"CorporateLife.1929,1937": $B -=[$$$ Corporate Life $$$]=- P$
"CorporateLife.1931,1935,1939,1943,1947,1951,1957,1961,1971":
$B Mini-Cat 4/96 P$

Home