| Description:
|
Details
Markiz_II Family
These are not dangerous parasitic viruses. "Markiz.1024" is a nonmemory resident virus. It searches for EXE files and writes itself to the end of the file. "Markiz.2642" is an encrypted memory resident virus. It hooks INT 21h and infect files that are executed. It writes itself to the beginning of COM and to the end of EXE files except files (anti-viruses): AIDS, ANTI, WEB, -V, SCAN, VSAFE, MSAV, NAV.
On 28th of any month "Markiz.1024" displays the message:
Virus ***MARKIZ-1*** for EXE files specification.
(C) by PLcat /demo version 1.0/
Was great in Almaty, Kazakhstan, 28.12.94. Good luck!
Under debugger "Markiz.2642" displays the message and reboots the computer:
+------------------------------------------------------------+
¦ Virus *** MARKIZ-2 *** for COM&EXE&OVL files specification ¦
¦ (C) by PLcat, version 2.0 /experimental version/ ¦
¦ Created in Almaty, Kazakhstan, 21.05.95. ä" ¡"óds óßGaÑt! ¦
+------------------------------------------------------------+
This virus also hooks INT 8 (timer) and in some time displays the picture:
+------------------+
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦/¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦/ ¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦--¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ ¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
¦ M A R K I Z -- 2 ¦
+------------------+
Depending on the system date it also hooks INT 9 (keyboard) and on Alt-Ctrl-Del (warm reboot) manifests itself by a video effect. |
