Name: KeyPress.93 Category: Viruses Description: Details KeyPress.935 There are memory-resident dangerous parasitic viruses. They hook INT 1Ch, 21h and write themselves to the end of COM and EXE files that are executed or opened. In COM files the virus overwrites the the first 16 bytes of the beginning with Jmp-Virus routine. The viruses periodically call INT 9 (keyboard). "Keypress.935,1000" erase the disk sectors, and contain the text strings: "Keypress.935": Chaos&Amber "Keypress.1000": King worm "Keypress.1199" hooks INT 1Ch and depending on its internal counter reboots the computer. "Keypress.1216.b,ß" do not call INT 9, they display: SAMSOFT "Keypress.1216.d" hooks INT 1Ch and sometimes displays symbol FFh (ASCII). It contains the text strings: FRED FREDDY_SOFT FREDDY_SOFT FREDDY_SOFT FREDDY_SOFT FREDDY_SOFT FREDDY_SOFT "Keypress.1236" displays: SADDAM, the inferiority of the chaos "Keypress.1250,1479" display: Mubark is caw "Keypress.1600" hooks INT 09h, 1Ch, 21h. Depending on its internal counters it displays the messages: HELLO SHSHTAYY GODBYE AMIN 00 ZAGAZIG UNIVER Keypress.BBS.1258 It intercepts Open File function (INT 21h, AH=3Dh) and if the file name is USER.BBS, the virus writes to that file login information about new user, and gives maximum privileges to that user. The text strings (register information) are: User.Bbs Platon Potapov SPb 311-63-83 Alfred