| Description:
|
Details
Ninja.1225
These are very dangerous memory resident parasitic viruses. They hook INT 21h and infect COM and EXE files except COMMAND.COM and AIDSTEST.EXE. Before and after infecting a file the viruses write to the end of the file blocks of random data of random length (from 0 till 255 bytes), the result looks as follows:
+------+------+---------+---+
|File |XXXXXX|Virus |XXX|
+------+------+---------+---+
Sometimes the viruses overwrite the files with a small program that decrypts and displays the message:
"Ninja.1336":
DZINA VIRUS v 4.0 Copyright (C) 1990,91,97 Dzina Corp
"Ninja.1370,1376":
Mutant Ninja Version 2.0 Copyright (C) 1990,91 Virus&Worm Software
In 1992 on 13th of any month the viruses erase the FAT of C: drive. They also contain the texts:
COMMAND.COM AIDSTEST.EXE .COM .EXE
Ninja.Craz
It fails to detect itself in already infected files, and affects them two and more times. Depending on the system date and time it plays a tune, corrupts the files, erases the disk sectors and reboots the computer. It contains the text:
Mutant VIRUS Copyright (C) 1996,97 Craz Software
Ninja.Raving
These are harmless viruses. These viruses infect the same EXE file two and more times. "Raving.1195" contains the text:
It's a beautiful life!
Can't stop raving |
