| Description:
|
Details
Avatar.Acid.670
These are very dangerous parasitic viruses. Some of them corrupt disk sectors. They contain the internal texts:
"Avatar.Acid.670,674": [Binary Acid] (c) 1994 Evil Avatar
"Avatar.Acid.736": Virus ANuBiS v.1.0 (c) 1994 Æ Ü !
Realizado en Argentina [AVRL]
This is only the beginningall
"Avatar.BigBang.346": [Big Bang] (c) 1993 Evil Avatar *.COM
"Avatar.Dichotomy": [Dichotomy] (c) 1994 Evil Avatar
[Dichotomy]
"Avatar.K_Rad.561": Made in the USA
[k-rad] by Evil Avatar
"Avatar.Positron.512": [Positron] (c) 1994 Evil Avatar
Avatar.Acid
These are memory resident viruses. They hook INT 21h, and write themselves to the end of COM and EXE files that are executed. On Monday, they erase a randomly selected disk sector.
Avatar.BigBang.346
This is a non-memory resident virus. It searches for .COM files and writes itself to the end of the file. On January 1st, it corrupts the MBR of the hard drive.
Avatar.Dichotomy
This is a dangerous memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of files that are being executed. It correctly infects COM files only, but also infects EXE files. Infected EXE files cannot replicate, they halt the system when executed.
This virus infects files by different manners. The sequence of executed files is divided into two sub-sequences - "odd" files and "even" ones. The virus splits itself into two parts (296 and 567 bytes), and writes the first part to the end of "even" files, and appends the second part to the end of "odd" files. The "even" files are infected by a standard "virus" manner: the first three bytes of the file are replaced by a "JMP Virus" instruction. The beginning of "odd" files is not changed, these files do not replicate the virus upon infection.
Upon execution of an "even" file, the first part of the virus searches for an "odd" file (its name is stored in the code of first part), reads the second part into the system memory and stays resident.
In some cases, the memory resident copy of that virus writes both parts of the code into the same file: upon infection, the files on floppies and the first part of the virus cannot locate the second one.
This is the first virus, which uses this a'la "binary arm" algorithm: this virus replicates itself if there are two infected files with different parts of the virus.
Avatar.K_Rad
It is a benign memory resident parasitic virus. It hooks INT 9 and 21h, and writes itself to the end of EXE files that are executed. By hooking INT 9, it capitalizes (on the screen) the letters that are entered via the keyboard.
Avatar.Positron
This is a dangerous memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of COM files that are executed.
The virus does not overwrite the file header with the JMP_Virus instruction, but writes it to the file middle. When the file is executed, the virus passes that call and doe not infect the file, but waits for the first INT 21h call when the file is working. When that call is detected, the virus calculates the address from where the call goes, and writes a JMP_Virus instruction there. As a result, that virus receives control not from the file beginning, but from the file middle, at the offset of first INT 21h call.
The virus may corrupt packed and some other types of files. These files halt the system when they are executed. |
