|
|
Vienna Famil Viruses Information
| Name: |
Vienna Famil |
| Category: |
Viruses |
| Description:
|
Details
Vienna Family
These are non-memory resident parasitic viruses. Upon execution, they search for .COM files in the current directory and directories that are listed in PATH string, then they write themselves to the end of the file.
The majority of these viruses, while attempting to infect a file, check the amount of seconds (or month, depending on the virus version) in a file's date and time stamp. If it is 1Fh (62 sec, correspondingly 0Dh - 13th month), then they do not infect the file.
Some viruses of this family, depending on the system timer, might corrupt the files, writing to the beginning of the file 5 bytes of the following commands: JMP F000:FFF0, JMP C800:0005, JMP C800:0000 or JMP C800:0006, depending on the version of the virus. "Vienna.648.b" ("Lisbon") writes the text "@AIDS" to the beginning of the file. These files are not recoverable and should be deleted.
The viruses contain the string "*.COM" and:
"Vienna.457": (C) ITV85020203
"Vienna.458": DUSHANBE M&A
"Vienna.466": Gosia
"Vienna.483": Kiev 1990
"Vienna.534": Microsoftyright Microsoft 1988
"Vienna.547": Hey you! You are lucky! YOU HAVE ME!!!
written in WARSAW (c) Plumbum
"Vienna.547": IBM
"Vienna.573": PERSEUS by Mr Doctor
"Vienna.625": Greetings from Ivanov V." (string is encoded);
"Vienna.648.b": @AIDS";
"Vienna.679": -+[BetaBoys]+-
"Vienna.700": <* Vienna-D Scan String Eliminator Field Test, (C) 1991
RABID International Development Corp *>
"Vienna.726": (c) Copyright IBM Corp 1981,1987 Licensed Material -
Program Property of IBM
"Vienna.732": SKISM ReplicatoR
FiRe is a LAMERall destroy InFiniTy!
"Vienna.742": BlackICE [FoG] Mobius Sobriquet
"Vienna.777": I come to you from The Ayatollah! (c)1990, VirusMasters
An Iraqui Warrior is in your computer...
"Vienna.777.b": -=IWG=-=IWG=-=IWG=-=IWG=-=IWG=-=IWG=-=IWG=-=IWG=-=IWG=-
IraquiWarriorG (C) '93 by Grog - Italy
"Vienna.939": (C) Monxla
"Vienna.Norilsk.481": /I l A.B./
"Vienna.Norilsk.520": /MW Soft./1993Feb6/Norilsk/Shura M./Depeche Mode/
"Vienna.SPb.641": C-641.SPb Sankt-Petersburg (C) 1992
"Vienna.W13.600": I am back... The world will hear from me again.
Pray for your disks NEW (c)W13 1994
Some viruses sometimes display the texts: "Vienna.311" renames the COMMAND.COM file to COMMAND.CON.
"Vienna.457": on Friday 13th, it releases the system memory occupied by the host program.
"Vienna.644" affects files only under the condition that the amount of system-timer minutes is less than 20. The virus alters 5 bytes of the file beginning (PUSH CS; POP DS; CALL Loc_Virus), sets some bits of the time in time and date stamp (OR 1234h).
"Vienna.730" erases the disk sectors and deletes the files. This virus also contains the text:
BetaBoys Present: Memo v2.0 /MaZ
"Vienna.757" modifies the first 4 bytes of a file, it does not infect the COMMAND.COM file.
"Vienna.774" overwrites the .COM files with a Trojan program that erases the FAT of the C: drive and displays:
<<>> THE GRITHER <<>>
Courtesy of Elexion
"Vienna.716,1000" sometimes formats the disk sectors.
"Vienna.778" decrypts and displays:
Only GHOSTBUSTERS would repair this disk now !!!
It also contains encrypted string:
STANISLAV SLACKA
"Vienna.849" erases the disk sectors and displays:
Matthew Stolarski - "A Loser in deep trouble..."
Matthew Stolarski is a born loser...
Let's kill him!!!!
YAM '92. Remember that name.
"Vienna.851 and 943" display the messages and erase the disk sectors:
Sorry this computer is no longer operational due to an outbreak of
Bushishiro Have a NICE day
VIPERizer, Strain B
(c) 1992, Stingray/VIPER
Happy Valentines Day!
"Vienna.988" upon execution displays:
Vio-Lite, TAA, Virulent Graffiti, (k) 1992
Sometimes it displays another text:
a MeSSaGe FRoM ViRuLeNT GRaFFiTi,
PLeaSe ReMeMBeR:
VG DoeS NoT BeLieVe iN PeRMiNaNTeLY DeSTRoyiNG DaTa, JuST
FuCKiNG WiTH YouR MiND! aNoTHeR oNe FRoM VG GoeS DoWN WiTHouT a HiTCH!
SMaSH a KeY [ ]
In November, "Vienna.1014" formats the hard drive sectors, it also contains the text:
Interceptor - (c) by Cracker Jack 1991 IVRL Milan, Italy
"Vienna.1055" formats the disks, and contains the following text:
TransMogrified (TM) 1990 by RABID N`tnl Development Corp.
!!!!!!!!!!!!!!!!!!!!!!!!!!!
!Copyright (C) 1990 RABID !
! !
!Activation Date: 08/15/90!
! !
! - Violator Strain B - !
! !
!(Field Demo Test Version)!
! *NOT TO BE DISTRIBUTED* !
!!!!!!!!!!!!!!!!!!!!!!!!!!!
"Vienna.1059" contains the strings:
Pat Tinaggio
Dan Zerino
Al Galoppo
=- DanZerino (C) '93 by GROG - Italy -=
>>7/93<<
---------------------------------------------------------------
? Dan Zerino, il famoso pattinatore, era preoccupato. ?
? La sua partner, Pat Tinaggio, era innamorata. ?
? Partecipando a uno spettacolo a Denver, ?
? aveva avviato una relazione con un cowboy di nome Al Galoppo. ?
---------------------------------------------------------------
"Vienna.1881" from December 19th till January 1st draws a Christmas tree:
*
*
**_**
*****_*****
**_**
****_****
*******_*******
***********_***********
****_****
******___******
*********___*********
************___************
****************___****************
********************___********************
************************___************************
_ Merry Christmas _
* _ & _ *
*_* _ a Happy New Year _ *_*
**_** _ for all my lovely friends _ **_**
****_**** _ from _ ****_****
******_****** _ FATHER CHRISTMAS _ ******_******
_______________________________
"Vienna.5286 and 5302" format the disks, display the tree and write the following message to the MBR:
Violator Strain B4 - Written by The RABID Nat'nl Development Corp.
RABID would like to take this opportunity to extend it's sincerest
holiday wishes to all Pir8 lamers around the world! If you are
reading this, then you are lame!!!
Anyway, to John McAffe! Have a Merry Christmas and a virus filled
new year. Go ahead! Make our day!
Remember! In the festive season, Say NO to drugs!!! They suck shit!
(Bah! We make a virus this large, might as well have something positive!)".
Vienna.Ambalama.493
contains the following texts:
(C) BLACK STAR Inc., 1991. USA,BOX 13263,Ambalama Called from: BBS (095)
135-62-53
Vienna.BigPiter
consists of two blocks. The first block ("head") is practically similar to the "Vienna.648" virus - it infects files and summons the second block. The second block (main) is written in C language and compiled with the Microsoft C compiler. The main block displays a picture of a computer and the following text:
regional engeneering centre LENINFORMATIKA ...
then it might (depending on some preconditions) install a memory-resident program that disables writing to the hard disk. The virus is very dangerous; it can delete COM files that are 40K or more in the length. Apart from the above text, it contains all text strings that are the Microsoft C compiler messages. The virus temporarily hooks INT 60h, and uses it to summon the main block of code.
Vienna.BNB.429
These are harmless viruses. They contain the following text strings:
*.COM *.COM DOS*.COM
and
"Vienna.BNB.429.a": Beware the Beast-N-Black (C) 1992
"Vienna.BNB.429.b": Public enemy number one
Vienna.ByteWarrior
is a benign encrypted virus. It contains/displays the following messages:
---> BYTE WARRIOR GOTCHA! <---
BYTE WARRIOR says:
We spit on those who choose to pose
and trash with all the rest.
Your Harddisk(s) had choosen to pose ...
now they are trashed like the rest!
WARRIOR is gotcha!
Vienna.DDrUS
erases the disk sectors, and contains the following text:
DDrUS (C) - 1990
Vienna.Feliz.518
Depending on the system date and time, displays one of the following messages:
Feliz Navidad!
Feliz Año Nuevo!
It also contains the text:
(C) 1991.
Vienna.Feliz.923
Depending on the system date and time, plays a tune and displays the following messages:
Si amas algo
déjalo libre.
Si regresa
es tuyo
si no,
nunca lo fué.
Feliz Cumpleaños.
Vienna.Oscar
are the variants of standard "Vienna.648", containing the following text string:
(C) OSCAR
Vienna.Pivi.568
overwrites the files with the string:
-=[ Poison Ivy ]=-
Slowly strangle your system.
Poison you programs.
Vienna.Violator
erase/format the disk sectors, display/contain the strings:
"Vienna.Violator.779,801,821":
Violator Strain C - (C) 1991 RABID Int'nl Development Corp.
Violator strikes again...
"Vienna.Violator.843":
Violator Strain B3 - RABID Nat'nl Development Corp. PATH=*.COM
"Vienna.Violator.957":
Violator B2 (C) '9O RABID Nat'nl Development Corp.
"Vienna.Violator.2262":
Big Caibua! RABID is Actually NAMBLA... Go figure...
High Evolutionary Sucks BIG CAIBUA!
You bastardize code, I bastardize it again! Fuck You!
Difference is you cocksucker, I can actually program in assembler...
Read about it in VSUM! btw, Patty, Howabouts ya lick my BIG CAIBUA?
Oh, And John, Just in case you think I forgot your sorry ass...
The next one is for you!!! Muhahahahahahahahahaha!!!! O.J. IS GUILTY!!
Tempest, Live for yourself... You do not know what love is yet...
wait, it will come... No worries... ;) |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 72 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win16.Klon.1177 - 42 visits
Win32.Hidra - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
V.153
Crawler.54
Anxiety.135
Chapa Famil
JindraBoo
Win32.HLLC.Na
AmazonQueen.46
Dada_II.78
HappyNewYear.55
RipTerminator.47
|
|
