Virus Database

Davis

Description Davis

It's a not dangerous memory resident encrypted parasitic virus. It hooks INT 21h and INT 8 (timer). It infects EXE-files only on their execution. Sometimes it beeps several times and types the message:
+--------------------------------------+
¦ DAVIS VIRUS V1.01¦
+--------------------------------------¦
¦ Author : Davis ¦
¦ Date : JUNE/23/1990 ¦
¦ ¦
¦ VIRUS STATION COPY RIGHT (C) ¦
+--------------------------------------+
""" Hi ! How are you today ? Don't worry about ! """
""" DAVIS VIRUS will follow you forever and ever ! """
""" Don't care me! I really do not damage your disk or data. """
""" Butall.......................make Funny to you sometime. """

Check other viruses! Be aware! Use Antiviral Software

Pcbb Family

Description Pcbb Family

These are dangerous memory resident parasitic encrypted (except "Pcbb.1141") viruses. They hook INT 9, 1Ch, 21h and write themselves to the end of COM files that are accessed. They also may infect the data files, that is the result of bug in the virus.
The infected files have the text string at the end of the file:
PCBB

These viruses check the keyboard input, and after some keystrokes they change the EGA palette. The viruses contain the encrypted strings:
"Pcbb.1141": Pc Byte-Bandit (c) VaXiNe '92
"Pcbb.1656": Pc Byte-Bandit (c) NoViA 1992
"Pcbb.1658": Pc Byte-Bandit (c) Demoralized Youth 1992
"Pcbb.1658.b": Pc Byte Bandit ver5
"Pcbb.1701": <> Demoralized Youth <>
PCBB, version 3.0 Written by <: Charlie! :>
"Pcbb.1800": Patrick Koehrs R.B R.B. Pc Byte Bandit, version 0.70

"Pcbb.1656,1658" corrupt NewEXE files: they overwrite the DOS part of these files with a small program that deletes the host file being executed. The viruses also overwrite a part of NewEXE file with the text:
This is thy present world, said the Flame to the Spark.
Thou art myself, my image, and my shadow. I have clothed
myself in thee, and thou art my vehicle to the day, "Be
with us," when thou shalt re-become myself and others,
thyself and me.

"Pcbb.1658.b,1701,1800" viruses contain seven different variants of decryption routine. They select one of these routines according to day number, append this routine to the file and then encrypt and write into the file their bodies.
"Pcbb.2277" is not a dangerous virus. It hooks INT 9, 1Ch, 21h. This virus manifests itself with a video effect. It contains the text string
5FI5SH5&W5HA5LE

While infecting that virus appends to the file the random number of NOP opcode, decryption code and encrypted virus body. The virus selects the decryption routine from 7 different variants.
"Pcbb.3072.*" are the variants of "Pcbb.2277", they contain the strings:
5FI5SH5&W5HA5
When you are demoralizedall. there is NO way out!
PCBB

They also contain the strings:
"Pcbb.3072.b": PCBB v11 (c) Hannibal Lechter of Demoralized Youth Norway.
"Pcbb.3072.b": Pc Byte Bandit, version 0.71
"Pcbb.3072.e": PCBB v11 (c) -*DRE/MER*- of Demoralized Youth

Pcbb.J4j
There are harmless memory resident viruses. They hook INT 21h and write themselves to the end of COM files that are executed. The viruses contain the word:
J4J

and:
"Pcbb.J4j.833": Jump 4 Joy, alpha-release. Not to be distributed!
"Pcbb.J4j.1273": Eloï, Eloï, lamá sabaktáni?
Charlie says: Support ()DEMORALIZED YOUTH()

Pcflu.2112

Description Pcflu.2112

This is a not dangerous memory resident parasitic polymorphic virus. It hooks INT 21h, 27h and writes itself to the end of EXE files and to the beginnings of COM files, some "Pcflu" infects only EXE files. While executing it checks the system and sometimes displays the message:
Incorrect DOS version
Then it returns to DOS.
The virus contains the text string:
PC-FLU Mk II by Wizard 1991
Some of the viruses from this family hooks INT 8 (timer) and 9 (keyboard) sometimes. Then they periodically 'skip' the keys that are entered.

Home