Virus Database

Dark.1016

Description Dark.1016

These are very dangerous non-memory resident parasitic viruses. They search for COM (except COMMAND.COM) and EXE files, then write themselves to the end of the file. On Mondays, if it is the 16th day of the month, the viruses overwrite the boot sector of the current drive with a Trojan program that reboots a computer when executed; then the viruses display the following message:
Welcome to the Dark Apocalypseall Your computer will
never escape... You might as well read this and weep!
The Dark Apocalypse v1.00 by Crypt Keeper [RoT]
TTReign of TerrorTT [DARK APOCALYPSE]
Press any key to continue...

and print the screen by a INT 5 call, and reboot a computer. These viruses also contain the text strings:
COMMAND.COM *.EXE *.COM

Check other viruses! Be aware! Use Antiviral Software

Asmodeous Family

Description Asmodeous Family

These are dangerous memory resident encrypted parasitic viruses. They hook INT 21h and write themselves into the middle of COM and EXE files that are executed or opened.
The viruses are divided into 10 blocks of code. While infection the viruses rearrange these blocks in randomly selected order (see "Badboy" viruses).
On November 11th these viruses delete the files when FindFirst/Next (AH=4Eh,4Fh) DOS calls are performed.
The viruses contain the internal text strings:
"Asmodeous.1160": ASMODEOUS
"Asmodeous.1343,1829,1833": Asmodeous
"Asmodeous.1437,1450": Asmodeous 9C

AsmVir Family

Description AsmVir Family

These viruses search for .ASM files and overwrite them with virus' hexadecimal dump. While overwriting the viruses add to this dump the assembler instructions that allow to compile and link infected .ASM files:
;~ <- virus ID
casmseg segment
assume cs:casmseg,ds:casmseg,ss:casmseg
org 100h
.radix 10
start:
db all <- virus hex dump
db ...
casmseg ends
end start

Being compiled and linked infected .ASM files can spread the virus.
The viruses also contain the text:
ASMVirus by Qark/VLAD042

Home