..903This is a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files (except ) that are executed. On December, 27th it erases the hard drive sectors. It also hooks INT 17h (printer) and sometimes prints rude messages in Russian. The...
..cpeThis worm creates copies of itself on removable storage media. It is a Windows PE EXE file. It is 73728 bytes in size. Installation Once launched, the worm copies its executable file to the Windows system directory: %System%\ Propagation The worm copies its executable file to all...
...1063It is a very dangerous memory resident parasitic virus. IT hooks INT 21h and infects COM files that are executed, and deletes the files that are opened. It infects the memory like "Cascade" virus, but contains several errors. It installs, infects and deletes the files only upon monochrome monitor...
..iThis malicious program is a worm. It is a Windows PE EXE file. It is 71 168 bytes in size. It is packed using UPX. The unpacked file is approximately 240KB in size. Installation When launched, the worm creates the following folder: %System%\ace When launched, the worm extracts the following file...
..euThis Trojan is a Windows PE EXe file 3584 bytes in size. Once launched, the Trojan registers this file in the system registry, ensuring that it will be launched each time Windows is rebooted on the victim machine: [HKCU\Software\Microsoft\Windows\CurrentVersion\Runonce] "MSSetup"="path to...
.haThis Trojan belongs to a family of programs designed to steal system passwords. It steals confidential data about the victim machine, including passwords and information entered via the keyboard. The Trojan itself is a Windows PE EXE file approximately 68KB in size, packed using ASPack. The...
.genThis family of Trojans steals passwords to the online game Legend of Mir. As a rule, programs belonging to this family are written in high-level programming languages such as Delphi, Visual C/C++, Visual Basic). File sizes vary, and the programs utilize a range of methods to install themselves to...
..833This is a harmless companion virus. It creates COM files with the same name as EXE file if found, and writes itself into this COM file. This a memory resident virus. It hooks INT 21h, and hits .EXE files that are executed. In April,0, the virus types: Your PC is Cloned! It also contains the...
WormC_.aLovesan is an Internet Worm which exploits the DCOM RPC vulnerability in Microsoft Windows described in MS Security Bulletin MS03-026. Lovesan is written in C using the LCC compiler. The worm is a Windows PE EXE file about 6KB (compressed via UPX - 11KB when decompressed). Lovesan downloads and...
..aThis Trojan has a malicious payload. It is 649 bytes in size. It is written in Visual Basic Script.
.aLovesan is an Internet Worm which exploits the DCOM RPC vulnerability in Microsoft Windows described in MS Security Bulletin MS03-026. Lovesan is written in C using the LCC compiler. The worm is a Windows PE EXE file about 6KB (compressed via UPX - 11KB when decompressed). Lovesan downloads and...
. is not a dangerous, memory resident parasitic virus. It was written in the assembler language. It uses system calls (syscall) while working with files. The virus infects ELF files. It writes itself to the middle of the file. After starts the virus divides a main process and continues its work...
. worm infects computers running under Windows. It spreads via poorly protected network resources. The worm itself is a PE EXE file. It is written in Microsof Visual C++. The file is approximately 37KB in size. It is not packed in any way. Installation Once launched, the worm copies itself...
..1683This is a memory resident harmless virus which infects COM and EXE files by standard manner. It infects the memory only if the INT 13h vector points to memory area with address lesser than address of the first MCB. The virus changes the first 5 bytes into INT 13h, 21h, 22h handlers to instruction...
..2071There are dangerous nonmemory resident viruses. They overwrite all .COM and .EXE files of the current directory. They contain lot of decrypted text strings and display some of them. Silver.2071 It contains the text strings: Copyright(C) 1992 by CU, Boulder Colorado. Program too big to fit in...
. worm uses the Internet instant messaging system ICQ to spread via the Internet. The worm sends ICQ users a message with a URL, which is linked to a file which contains procedures to automatically download and execute the malicious component of the worm on the victim computer. Propagation On...
..846These are very dangerous memory resident parasitic viruses. They hook INT 21h and write themselves to the end of COM and EXE files that are executed. While changing a current directory the viruses search for the first EXE file, and infect it. When the file is executed the viruses disable...
..aThis Trojan has a malicious payload. It is 649 bytes in size. It is written in Visual Basic Script.
..lmThis Trojan has a malicious payload. It is a Windows PE EXE file. The file is 368 128 bytes in size. . It is not packed in any way. It is written in Borland Delphi.
..aeThis exploit uses a vulnerability in Internet Explorer (CVE-2006-3227) to run on the victim machine. It is an HTML page. It is 3616 bytes in size. It is not packed in any way.
..bnbThis worm propagates by creating copies of itself on local disks and write-accessible network resources. It is a Windows PE EXE file. It is 46592 bytes in size. It is packed using UPX. The unpacked file is approximately 107MB in size. Installation The worm copies its executable file to the...
..659This is a very dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the beginning of COM files that are opened. The virus contains the string: (C) CRASHER X On December 20th it erases C: drive sectors and displays the message: Dear users ! Hapy new year ! * / / /_ *...
..aThis Trojan (also known as Back Orifice Trojan) is a network-administration utility that allows for the controlling of computers on the network. "'Back Orifice' is a remote administration system, which allows a user to control a computer across a tcpip connection using a simple console or gui...
.rnThis Trojan belongs to a family of Trojans written with the aim of stealing user passwords. LdPinch is designed to steal confidential information. The Trojan itself is a Windows PE EXE file approximately 17KB in size, packed using UPX. When installing, the Trojan copies itself to the Windows system...
.. is a memory resident not dangerous virus which inserts itself into COM-files beginning at their creating: the infector hooks INT 21h, f.3Ch, creates the file, writes its body into this file and returns the control back to the program that called this function. And then that program appends the...
.aThis Trojan is designed to steal confidential data. It is a Windows PE EXE file. The size of infected files may vary from 147KB to 171KB. It is packed using AsPack. It is written in Delphi. Installation Once launched, the Trojan copies itself to the Windows root directory (%WinDir%) under one...
..gjThis Trojan is a Windows PE EXE file 61440 bytes in size. Once launched, the Trojan causes the following message to be displayed: It then creates a file called in the C: root directory: C:\ The Trojan terminates any processes it finds with the names listed below:...
._II.2000It is not a dangerous nonmemory resident polymorphic companion virus. It searches for .COM and .EXE files, then renames .COM files to .CCC and .EXE files to .EEE, then writes itself instead of host file. After infection the virus creates in the current directory the file and writes to...
..1918It is a very dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of .COM and .EXE files that are executed. On 10th, 20th and 30th of any month the virus erases the hard drive sectors, displays an image of Che Guevara and the text: TE GUSTA ESTAR BLOQUEADO A...
..kSurila is a Trojan backdoor. The program is a Windows PE EXE file packed with Obsidium and written in Visual C++. The packed file size is 244 KB and the unpacked size is approximately 413 KB. Installation Upon being launched, Surila copies itself into the Windows system folder under the name...
.-basedThis is a typical client-server remote administration utility that allows connection to remote computer(s) in order to manage its (their) system resources in real time (similar to "pcAnywhere" by Symantec). This utility has a "Remote-Anything" name, and it is developed and distributed by the TWD...
fileless worm, also known as BlackIce and Blackworm, infects computers which use the following vulnerable ISS products: RealSecure Network 7.0, XPU 22.11 and before RealSecure Server Sensor 7.0 XPU 22.11 and before RealSecure Server Sensor 6.5 for Windows SR 3.10 and before Proventia A...
..vThis Trojan program makes it possible for a remote malicious user to manage the victim machine. It is a Windows PE EXE file. It is written in Visual C++. It is not packed in any way. The file is 924 bytes in size.
..743This is a harmless memory-resident parasitic virus. It hooks INT 21h and writes itself at the end of COM files that are executed. It contains the text "am", the same value is returned (in ASCII) by the virus when it checks the previously loaded TSR copy. On calling the GetDate DOS function the...
.. is a memory resident not dangerous virus which inserts itself into COM-files beginning at their creating: the infector hooks INT 21h, f.3Ch, creates the file, writes its body into this file and returns the control back to the program that called this function. And then that program appends the...
..1971It's a not dangerous memory resident parasitic virus. It hooks INT 21h and writes itself at the end of COM- and EXE-files are executed. Sometimes it hooks INT 08h (timer) and plays several tunes.
..aThis Trojan has a malicious payload. It is 343 bytes in size, and written in Visual Basic Script.
..1972This is a dangerous memory resident multipartite virus. While executing an infected EXE file the virus writes itself to the boot sector of the C: drive and then returns the control to the host file. While loading from infected disk the virus hooks INT 8, waits for DOS loading procedure, allocates...
..gnThis Trojan downloads other files via the Internet and launches them for execution on the victim machine without the users knowledge or consent. It is an HTML page which contains Visual Basic Script. It is 1445 bytes in size.
..1788These are very dangerous memory resident parasitic polymorphic viruses. They trace and hook INT 21h, then they write themselves to the end of COM and EXE files that are executed or opened. Depending on their internal counters the viruses erase the MBR of the hard drive and then display the message:...
..599This is a benign non memory-resident parasitic virus. Upon being executed, it searches for all COM files of the current directory, and writes itself to the end of the file. On December 25th, upon being executed, the virus immediately returns to DOS. The virus contains the text string: *.COM...
.lfiThis malicious program is a Trojan. It is a Windows PE EXE file. It is 123873 bytes in size. Installation The Trojan copies its executable file to the Windows system directory: %System%\ In order to ensure that the Trojan is launched automatically each time the system is restarted, the...
.rnThis Trojan belongs to a family of Trojans written with the aim of stealing user passwords. LdPinch is designed to steal confidential information. The Trojan itself is a Windows PE EXE file approximately 17KB in size, packed using UPX. When installing, the Trojan copies itself to the Windows system...
..983This virus infects .OBJ files prepared to be compiled to COM files. The virus inserts itself into OBJ files so, that after linking to COM executable file the result contains the virus at the beginning of the file. When that file is executed, the virus receives the control, hooks INT 21h and...
..pThis exploit uses a vulnerability in Internet Explorer (CVE-2006-3227) to run on the victim machine. It is an HTML page. It is 1872 bytes in size. It is not packed in any way.
._II.466It is not a dangerous nonmemory resident parasitic virus. It searches for .COM files, then writes itself to the end of the file. The virus displays the messages: This file contains a virus! Please COLD-boot from a write protected system disk and use you anti virus software! Dit virus is ter...
..846These are very dangerous memory resident parasitic viruses. They hook INT 21h and write themselves to the end of COM and EXE files that are executed. While changing a current directory the viruses search for the first EXE file, and infect it. When the file is executed the viruses disable...
..487These are very dangerous nonmemory resident encrypted parasitic viruses. They search for .COM files in the current and parent directories, then write themselves to the end of the file. Before return control to the host program they erase disk sectors and display the message: Inherit the Wind...
..gnThis Trojan downloads other files via the Internet and launches them for execution on the victim machine without the users knowledge or consent. It is an HTML page which contains Visual Basic Script. It is 1445 bytes in size.
Backdoorxactengine2_. Troajn program can be used for remote administration of the victim machine. It has both a client and a server component. The server component is written in Microsoft Visual C++. It is 28672 bytes in size, and is not packed in any way. The client component is also written in Microsoft Visual...