Virus Database

DeadHead.992

Description DeadHead.992

It is a dangerous nonmemory resident encrypted parasitic virus. It searches for .COM files, then writes itself to the beginning of the file. The virus has bugs and often halts the system instead of infection. Depending on its data the virus corrupts the boot sector of the C: drive and displays the message:
[XtZ] by dEAdhEAd (StupidVir).

In case of error while infecting a file the virus displays the message and returns to DOS:
Incorrect D0S version

Check other viruses! Be aware! Use Antiviral Software

Kitiara.288

Description Kitiara.288

It is a very dangerous memory resident overwriting virus. It hooks INT 21h and overwrites each file that is executed. Before returning control to DOS the virus displays:
Bad command or filename

On September 1st it overwrites all files in the current directory with the text:
Kitiara 1.0
Coder: The Exectioner

Kiuca family

Description Kiuca family

These are harmless memory resident multipartite viruses. They infect COM and EXE files as well as the boot sector of C: drive. When an infected file is executed, the viruses infect the hard drive - they write their code and the original boot sector of C: disk to the track/head 0/0 on the hard drive and overwrite the C: disk boot sector with their loading routine.
While loading from infected hard drive the virus copies itself to the top of system memory, hooks INT 1Ch, waits for DOS loading process, then hooks INT 21h and when any program is executed, completes installation routine - allocates a blocks of DOS memory and copies itself to there. As a result the virus does not decreases the total size of DOS memory, but places itself between DOS kernel and COMMAND.COM. The virus then writes itself to the end of COM and EXE files that are created and then closed.
The virus several tricks to avoid detection by integrity (CRC) checker. It infects only newly created files, or files that are restored from archives of backup, as a result there is no information about these files in CRC databases. To hide infected boot sector the virus disinfects it when any program (including anti-viruses) is executed, and re-infects on termination. As a result the disk boot sector is infected only when there are no programs in the system memory.
The virus contains the text strings in Russian and English:
(c) Light General.Kiev.KIUCA.1996.NOT for free use.

Home