Virus Database

Dream.2000

Description Dream.2000

These are not dangerous memory resident parasitic polymorphic viruses. They hook INT 13h, 21h and write themselves to the end of .COM- and .EXE-files that are accessed with INT 21h function 12h (FindNext FCB). The viruses contain the internal string "SCCLF-VIMSVSWI", and do not infect the files with the names from that string (two bytes per name): SC*.*, CL*.*, F-*.*, VI*.*, MS*.*, VS*.*, WI*.*. Depending on the internal counter the viruses return the error flag on INT 13h (Disk Services) calls. The viruses also contain the internal string:
[ Dream Man / Doctor Revenge ] 12-02-94 Italy

Check other viruses! Be aware! Use Antiviral Software

ArjDropper.402

Description ArjDropper.402

It is a harmless nonmemory resident virus-worm 402 bytes of length. When an infected file is executed, the virus searches for ARJ archives and appends its copy to archives that are found. The virus copy in archives is stored in format of ARJ data and has the filename RUNME.COM. This RUNME.COM file contains a copy of the virus, and being extracted from infected archive it may spread the virus code to other archives. The virus contains the text strings:
*.ARJ
ARJDrop by Qark/VLAD
RUNME.COM

ArjRar.2821

Description ArjRar.2821

This is a relatively harmless, non-memory resident virus-worm. It searches for ARJ and RAR archives and appends its copy to archives that are found. The virus copy in archives is stored in the format of ARJ or RAR data and has the filename RUNME.COM in ARJ archives and RUN_ME_.COM in RAR. These "run-me" files contain a copy of the virus, and upon being extracted from an infected archive, they may spread the virus code to other archives.
In August, the virus drops the file PRESENT.COM, and upon being executed, it displays the following texts:
Citat klasika:
K anielovi chrbtom.
Tak zacal som cestou hirechu ist.
K anielovi chrbtom,
len 12 krokov,
a 12 ozvien na ne,
a dosiel som tam,kam som nemal prist
Dedicated to my friends Suzy&PEDRO
[an ANGEL-Sign of immortality]
by Blesk 8^)
Present by Blesk wish You
HAPPY B-DAY
Suzy

The virus also contains the following text strings:
*.ARJ *.RAR
RAR'n'ARJ Dropper by Qark/VLAD.
RAR support included by Blesk

Home