Virus Database

Deathrider.729

Description Deathrider.729

This is a dangerous, non-memory resident overwriting virus. It searches for .COM- and .EXE-files of the current directory (by using masks *.COM *.EXE) and overwrites them. The length of the infected files grows by 39 bytes. On the 8th of every month, it types the following message:
------* DeathRider Virus version 1.8 *------
(c) 1993 DeathRider - Pretoria - South Africa

and then formats HD sectors and erases CMOS memory. On other days, it types one of the following messages:
Packed File Corrupt
Sharing violation
Required system component not installed

and returns to DOS. It also contains the internal text: "ViRuZÑÑZ ".

Check other viruses! Be aware! Use Antiviral Software

Autumnal.3072

Description Autumnal.3072

It is a very dangerous memory resident multipartite virus. It infects the MBR of the hard drive and writes itself to end of .COM and .EXE files. While executing an infected file the virus infects the MBR, hooks INT 8, 13h, 21h and stays memory resident by DOS call Keep (INT 27h). While loading from infected disk the virus decreases the size of the system memory (the word at the address 0000:0413), hooks INT 8, 13h, waits for DOS loading, then hooks INT 21h and restores the size of the system memory to hide its TSR block.
While accessing to the files by DOS functions Exec, Open, Rename, FindFirst/Next both FCB and ASCII the virus infects the files except CO*.* and IB*.*. While accessing to infected MBR the virus calls the stealth routine. When an infected file is loaded for debugging, the virus disinfects it. If and error occurs while disinfecting, the virus displays the message:
Error in File

The virus uses anti-debug tricks. On July 13th it deletes the files instead of infecting them.
The virus contains the text strings:
Ver 4.00
(C)Copyright Autumnal Water Corp. 1991

AV_CK.508

Description AV_CK.508

It's a harmless memory resident parasitic virus. It hooks INT 21h and writes itself at the end of EXE-files that are accessed. It contains the internal text string: "AV=CK".

Home