DM.674
Description DM.674
This virus is not memory-resident, very dangerous. Under some conditions it wipes out the first 80h sectors of the hard disk. The virus bypasses subdirectories of the current disk and writes itself into .COM-files by standard way. Beginnings of infected files become as follows:
MOV BX,offset Virus;
JMP BX;
DB 'DM'.
Check other viruses! Be aware! Use Antiviral Software
GV Family
Description GV Family
These are not dangerous memory resident parasitic viruses. They hook INT 9, 16h, 21h, 28h and write themselves to the end of COM-files that are executed. On pressing of Alt-Ctrl-V keys they display the messages:
"GV.2856":
+--------------------------------+
¦ Good Virus #1 Alpha Model ¦
¦ [GV1] ¦
¦ (c) 1994 by Stormbringer [P/S] ¦
¦ ¦
¦ Infection Mode: ¦
¦ [N]one ¦
¦ [I]nfect Files ¦
¦ [D]isinfect Files ¦
¦ ¦
¦ Encryption Commands: ¦
¦ [E]ncrypt File ¦
¦ De[C]rypt File ¦
¦ ¦
¦ Press [ESC] To Exit Menu ¦
+--------------------------------+
"GV.2865":
+--------------------------------+
¦ Good Virus #1 1.01 ¦
¦ [GV1] ¦
¦ (c) 1994 by Stormbringer [P/S] ¦
¦ ¦
¦ Infection Mode: ¦
¦ [N]one ¦
¦ [I]nfect Files ¦
¦ [D]isinfect Files ¦
¦ ¦
¦ Encryption Commands: ¦
¦ [E]ncrypt File ¦
¦ De[C]rypt File ¦
¦ ¦
¦ Press [ESC] To Exit Menu ¦
+--------------------------------+
When the 'D' key is pressed they disinfect the infected files on their execution. When the 'E' or 'C' keys are pressed they encrypt/decrypt the file which is selected by the user. The viruses display the messages before encryption:
+-[Enter Filename Below]-+
¦ > ¦
+------------------------+
+----[Please Enter 16 Byte Password (Extra Chars Ignored)]----+
¦ > ¦
+-------------------------------------------------------------+
They also contain/display the internal strings:
"GV.2856":
Good Virus #1 Alpha (c) 1994 Stormbringer [P/S] Now Loaded.
Press CTRL-ALT-V For User Menu. Infection Set To NONE.
Error Opening File!
GV1
GoodVir1
"GV.2865":
Error Opening File!
GV1 v101
Gvirus.653
Description Gvirus.653
It's a not dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the ends of the .COM-files that are executed. The virus contains the string "COMMAND.COM" and infects this file on installation. After one month of infection the file displays: "Schon mal was von G-Virus gehört ?". It also contains the internal text string: "G-VIRUS V1.2".
|