Virus Database

Deliver.Digi.3547

Description Deliver.Digi.3547

This is a polymorphic stealth virus. It hooks INT 1, 3, 1Ch, 21h and writes itself to the end of COM- and EXE-files that are executed. While creating, opening and executing COM- and EXE-files it stores their names, and hits them on the files closing. On opening of infected files the virus disinfects them. On FindFirst/Next DOS calls it "decreases" the infected file length. The virus deletes CHKLIST.* files, while execution of CHKDSK utility it disables its FindFirst/Next handler, while execution of MKS anti-virus scanner is stops the infection. It disables the debugging of the virus code by hooking INT 1, 3.
On May, from 28th till 31th the virus overwrites the hard drive sectors with the strings:
DIGI POWER
Then it manifests itself with the video and sound effects, and displays the message:
DIGI POWER
THIS IS A NEW all
DELIVER II SÆëâlÆH (R) WRITE BY DiGiT! ... SOUTH POLAND 1995

Check other viruses! Be aware! Use Antiviral Software

HLLP.DH.7199

Description HLLP.DH.7199

HLLP.DH.7199 is a dangerous, non-memory resident parasitic virus. It is written in the high level language Pascal. The virus looks for EXE files in the directories from the PATH environment variable and writes itself to the beginning of EXE files. It marks infected files with last four bytes:
DH)!
It doesn't infect files with length less than 7195 bytes. On the 13th, 14th and 15th day of each month the virus erases all files in the subdirectories of the directories from the PATH environment variable.

HLLP.Feci.6000

Description HLLP.Feci.6000

This is a very dangerous non-memory resident parasitic virus. It searches for EXE files, and infects them by writing virus code to the beginning of the file. The original file contents is encrypted and moved down while infecting.
If an error occurs while infecting, the virus displays the following standard DOS error message:
General failure reading drive Abort, Retry, Ignore, Fail?
Depending on the system date, the virus erases disk data and displays a message. The message is partly written in Russian. The rest of the message appears as follows:
=== Feci Quod Potui, Faciant Meliora Potentes
This happens on April 10, 11, and 12; and December 28, 29, 30, and 31.

Home