Aussie Parasite Virus
Virus Name: Aussie Parasite
Aliases: Australian Parasite, Aussie Parasite.292
V Status: Rare
Discovery: January, 1993
Symptoms: .COM file growth; system hangs; boot failures;
decrease in total system & available free memory
Origin: Melbourne, Australia
Eff Length: 292 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: F-Prot, Sweep, AVTK, IBMAV, ViruScan, NAV,
NAVDX, VAlert, ChAV,
NShld, IBMAV/N, AVTK/N, Sweep/N, NProt, NAV/N, Innoc
Removal Instructions: Delete infected files
General Comments:
The Aussie Parasite, or Australian Parasite, virus was discovered
in Melbourne Australia in January 1993. Aussie Parasite is a memory
resident infector of .COM programs, including COMMAND.COM.
When a program infected with the Aussie Parasite virus is executed,
the Aussie Parasite virus will install itself memory resident at the
top of system memory but below the 640K DOS boundary. Total system
and available free memory, as indicated by the DOS CHKDSK program,
will have decreased by 320 bytes. Interrupt 21 will by hooked by
Aussie Parasite in memory.
Once the Aussie Parasite virus is memory resident, it will infect
.COM programs, including COMMAND.COM, when they are executed.
Infected programs will have a file length increase of 292 bytes with
the virus being located at the end of the file. The program's date
and time in the DOS disk directory listing will not be altered. The
following text string is visible within the viral code in all
infected programs:
"Australian Parasite"
System hangs frequently occur on infected systems, and the system
will fail to boot once the boot copy of COMMAND.COM becomes infected.
Known variant(s) of Aussie Parasite are:
Aussie Parasite.153.B: Based on the Aussie Parasite virus
described above, Aussie Parasite.153.B is a 153 byte variant.
It becomes memory resident in allocated system memory, hooking
interrupt 21 at 0046. It adds 153 bytes to the .COM programs
it infects, the virus being located at the end of the file. No
text strings are visible within the viral code in infected
files. The file's date and time in the DOS disk directory
listing will have been updated to the current system date and
time when infection occurred.
Origin: Unknown January 1995.
Aussie Parasite.155: Based on the Aussie Parasite virus described
above, Aussie Parasite.155 is a 155 byte variant. It becomes
memory resident in allocated system memory, hooking interrupt
21 at 0046. It adds 155 bytes to the .COM programs it infects,
the virus being located at the end of the file. No text strings
are visible within the viral code in infected files. The file's
date and time in the DOS disk directory listing will have been
updated to the current system date and time when infection
occurred.
Origin: Unknown January 1995.
Aussie Parasite.187: Based on the Aussie Parasite virus described
above, Aussie Parasite.187 is a 187 byte variant. It becomes
memory resident in allocated system memory, hooking interrupt
21 at 0046. It adds 187 bytes to the .COM programs it infects,
the virus being located at the end of the file. No text strings
are visible within the viral code in infected files. System
hangs frequently occur when infected programs are executed.
Origin: Unknown January 1995.
Aussie Parasite.213: Based on the Aussie Parasite virus described
above, Aussie Parasite.213 is a 213 byte version. Its size in
memory is 496 bytes, hooking interrupt 21. It adds 213 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text string can be found within the
viral code:
"KunPSR"
Infected files will have the month in the file date in the DOS
disk directory set to either "13" or "15".
Origin: Unknown January 1995.
Aussie Parasite.215: Based on the Aussie Parasite virus described
above, Aussie Parasite.215 is a 215 byte version. Its size in
memory is 480 bytes, hooking interrupt 21. It adds 215 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The file's date and time in the DOS disk directory
listing will not be altered.
Origin: Unknown January 1995.
Aussie Parasite.217: Based on the Aussie Parasite virus described
above, Aussie Parasite.217 is a 217 byte version. Its size in
memory is 480 bytes, hooking interrupt 21. It adds 217 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text string can be found within the
viral code:
"KunPSR"
Infected files will have the month in the file date in the DOS
disk directory set to "13".
Origin: Unknown January 1995.
Aussie Parasite.221: Based on the Aussie Parasite virus described
above, Aussie Parasite.221 is a 221 byte version. Its size in
memory is 240 bytes, hooking interrupt 21. It adds 221 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text string can be found within the
viral code:
"KutPSR"
Infected files will have the month in the file date in the DOS
disk directory set to "14" or "15".
Origin: Unknown January 1995.
Aussie Parasite.229: Based on the Aussie Parasite virus described
above, Aussie Parasite.229 is a 229 byte version. Its size in
memory is 240 bytes, hooking interrupt 21. It adds 229 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text string can be found within the
viral code:
"Ku{PSR"
Infected files will have the month in the file date in the DOS
disk directory set to "15".
Origin: Unknown January 1995.
Aussie Parasite.231: Based on the Aussie Parasite virus described
above, Aussie Parasite.231 is a 231 byte version. Its size in
memory is 496 bytes, hooking interrupt 21. It adds 231 bytes to
the .COM programs it infects, the virus being located at the end
of the file. No text strings are visible within the viral code.
The file's date and time in the DOS disk directory listing will
not be altered.
Origin: Unknown January 1996.
Aussie Parasite.272: Based on the Aussie Parasite virus described
above, Aussie Parasite.272 is a 272 byte version. Its size in
memory is 336 bytes, hooking interrupt 21. It adds 272 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text string can be found at the end
of all infected programs:
"AP"
Origin: Unknown July 1994.
Aussie Parasite.273: Based on the Aussie Parasite virus described
above, Aussie Parasite.273 is a 273 byte version. Its size in
memory is 304 bytes, hooking interrupt 21. It adds 304 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text string can be found at the end
of all infected programs:
"Australian Parasite"
Origin: Unknown January 1996.
Aussie Parasite.279.A: Based on the Aussie Parasite virus
described above, this is a 279 byte variant. It becomes
memory resident in allocated system memory, hooking interrupt
21 at 0044. It adds 279 bytes to the .COM programs it infects,
the virus being located at the end of the file. The program's
date and time in the DOS disk directory listing will not be
altered. The following text string is visible within the
viral code:
"TOKYO BABYLON, MUTATiON = GREED, TENTH OF TWELVE OVERLORDS"
Origin: Unknown January 1996.
Aussie Parasite.279.B: Based on the Aussie Parasite virus
described above, this is a 279 byte variant. It becomes
memory resident in allocated system memory, hooking interrupt
21 at 0044. It adds 279 bytes to the .COM programs it infects,
the virus being located at the end of the file. The program's
date and time in the DOS disk directory listing will not be
altered. The following text string is visible within the
viral code:
"WiKED CiTY, MUTATiON = JELOUSY, ELEVENTH OF TWELVE OVERLORDS"
Origin: Unknown January 1996.
Aussie Parasite.284: Based on the Aussie Parasite virus
described above, this is a 284 byte variant. It becomes
memory resident in allocated system memory, hooking interrupt
21 at 0044. It adds 284 bytes to the .COM programs it infects,
the virus being located at the end of the file. The program's
date and time in the DOS disk directory listing will not be
altered. The following text string is visible within the
viral code:
"LAUGHiNG TARGET, MUTATiON = HATRED, TWELVETH OF TWELVE
OVERLORDS"
Origin: Unknown January 1996.
Aussie Parasite.292.B: Received in August, 1994, this variant has
one byte which differs from the original virus.
Origin: Unknown August 1994.
Aussie Parasite.297: Based on the Aussie Parasite virus described
above, Aussie Parasite.297 is a 297 byte version. Its size in
memory is 320 bytes, hooking interrupt 21. It adds 297 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text string is visible within the
viral code:
"AKiRA, MUTATiON = LUST, FOURTH OF TWELVE OVERLORDS"
Origin: Unknown January 1996.
Aussie Parasite.305: Based on the Aussie Parasite virus described
above, Aussie Parasite.305 is a 305 byte version. Its size in
memory is 336 bytes, hooking interrupt 21. It adds 305 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text string is visible within the
viral code:
"GOLGO 13, MUTATiON = PERVERSiON, FiFTH OF TWELVE OVERLORDS"
Origin: Unknown January, 1996.
Aussie Parasite.306: Based on the Aussie Parasite virus described
above, Aussie Parasite.306 is a 306 byte version. Its size in
memory is 368 bytes, hooking interrupt 21. It adds 306 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text string is visible at the very
end of all infected files:
"AP"
Origin: Australia October 1994.
Aussie Parasite.306.B: Based on the Aussie Parasite virus
described above, Aussie Parasite.306.B is a 306 byte version.
Its size in memory is 336 bytes, hooking interrupt 21. It adds
306 bytes to the .COM programs it infects, the virus being
located at the end of the file. The following text string is
visible within the viral code:
"3x3 EYES, MUTATiON = SELFiSHNESS, NiNETH OF TWELVE OVERLORDS"
Origin: Unknown January, 1996.
Aussie Parasite.310: Based on the Aussie Parasite virus described
above, Aussie Parasite.310 is a 310 byte version. Its size in
memory is 336 bytes, hooking interrupt 21. It adds 310 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text string is visible at the end of
all infected files:
"DOOMED MEGALOPOLiS, MUTATiON = DECiET, SiXTH OF TWELVE
OVERLORDS"
Origin: Unknown January 1996.
Aussie Parasite.312.A: Based on the Aussie Parasite virus
described above, Aussie Parasite.312.A is a 312 byte version.
Its size in memory is 320 bytes, hooking interrupt 21. It adds
312 bytes to the .COM programs it infects, the virus being
located at the end of the file. The following text string is
visible within the viral code:
"ALiTA BATTLE ANGLE, MUTATiON = AVARiCE, FiRST OF
TWELVE OVERLORDS"
Origin: Unknown January, 1996.
Aussie Parasite.312.B: Based on the Aussie Parasite virus
described above, Aussie Parasite.312.B is a 312 byte version.
Its size in memory is 336 bytes, hooking interrupt 21. It adds
312 bytes to the .COM programs it infects, the virus being
located at the end of the file. The following text string is
visible within the viral code:
"CRYiNG FREEMAN, MUTATiON = DEBAUCHERY, SECOND OF
TWELVE OVERLORDS"
Origin: Unknown January, 1996.
Aussie Parasite.312.C: Based on the Aussie Parasite virus
described above, Aussie Parasite.312.C is a 312 byte version.
Its size in memory is 336 bytes, hooking interrupt 21. It adds
312 bytes to the .COM programs it infects, the virus being
located at the end of the file. The following text string is
visible within the viral code:
"DOMiNiON TANK POLICE, MUTATiON = ViCE, SEVENTH OF
TWELVE OVERLORDS"
Origin: Unknown January, 1996.
Aussie Parasite.315: Based on the Aussie Parasite virus described
above, Aussie Parasite.315 is a 315 byte version. Its size in
memory is 336 bytes, hooking interrupt 21. It adds 315 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text string is visible at the end of
all infected files:
"FiST OF THE NORTH STAR, MUTATiON = CONCiET, EiGTH OF TWELVE
OVERLORDS"
Origin: Unknown January 1996.
Aussie Parasite.320: Based on the Aussie Parasite virus described
above, Aussie Parasite.320 is a 320 byte version. Its size in
memory is 352 bytes, hooking interrupt 21. It adds 320 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text string is visible at the end of
all infected files:
"LEGEND OF THE OVERFiEND, MUTATiON = DECADANCE, THiRD OF TWELVE
OVERLORDS"
Origin: Unknown January 1996.
Aussie Parasite.352: Based on the Aussie Parasite virus described
above, Aussie Parasite.352 is a 352 byte variant. It becomes
memory resident in allocated system memory, hooking interrupt
21 at 0044. It adds 352 bytes to the .COM and .EXE programs it
infects, the virus being located at the end of the file. One
text string is visible within the viral code in infected files:
"AIH"
Origin: Unknown January 1996.
Aussie Parasite.369.B: Based on the Aussie Parasite virus
described above, Aussie Parasite.369.B is a 369 byte variant.
It is a non-resident, direct action infector of .COM files,
infecting one .COM file in the current directory each time an
infected program is executed. Infected files will have a file
length increase of 369 bytes with the virus being located at the
end of the file. The following text strings are encrypted
within the viral code in all infected programs:
"*.COM [Aussie Parasite vIRUS v. 1.1]"
"[bLAME oTHERS]"
Origin: Unknown January 1995.
Aussie Parasite.423: Received in January, 1996, this is a 423 byte
variant of the Aussie Parasite virus. Its size in memory is
736 bytes, hooking interrupt 21. It adds 423 bytes to the .COM
programs it infects, the virus being located at the end of the
file. The following text strings are visible within the viral
code in all infected programs:
"AIH:SLOWDOWN:BY DARK FIBER"
"SNOWING"
Origin: Unknown January 1996.
Aussie Parasite.424: Based on the Aussie Parasite virus described
above, Aussie Parasite.424 is a 424 byte version. Its size in
memory is 944 bytes, hooking interrupt 21. It adds 424 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text strings are encrypted within
the viral code in all infected programs:
"Anke Huber"
"is the best tennis player in the world."
"says the Australian Parasite."
"(C)'93 Aust. P"
Additionally, the text string "Anke Huber" can be found near
the beginning of all infected files.
Origin: Unknown January 1995.
Aussie Parasite.440: Based on the Aussie Parasite virus described
above, Aussie Parasite.440 is a 440 byte version. Its size in
memory is 896 bytes, hooking interrupt 21. It adds 440 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text strings are encrypted within
the viral code in all infected programs:
"Anke Huber is kicken butt on her way to be the number one
womens tennis player"
"Arantxa Sanchez-Vicario is a steroid abuser."
"P440???!!"
Additionally, the text string "ANKE" can be found near the
beginning of all infected files.
Origin: Unknown July 1994.
Aussie Parasite.482: Based on the Aussie Parasite virus described
above, Aussie Parasite.482 is a 482 byte version. Its size in
memory is 512 bytes, hooking interrupt 21. It adds 482 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text strings are visible within the
viral code in all infected files:
"The Hitcher virus. Hitchhiking through your system."
"Didn't your mum tell you not to pick up stray viruses."
"The Hitcher virus #1"
"by AP[AIH]"
"HITCHER"
Origin: Australia October 1994.
Aussie Parasite.491: Based on the Aussie Parasite virus described
above, Aussie Parasite.491 is a 491 byte version. Its size in
memory is 992 bytes, hooking interrupt 21. It adds 491 bytes to
the .COM programs it infects, the virus being located in the
middle of the file. The following text strings are visible
within the viral code in all infected files:
"This virus was written by Jack Kenyon to test out Virus
Buster."
"Phone (07) 343 8866 in Australia if you have any problems."
Origin: Australia October 1994.
Aussie Parasite.550.A: Received in January, 1993, this is a 550
byte variant of the Aussie Parasite virus described above. Its
size in memory is 608 bytes, hooking interrupt 21. Once
resident, infects up to two .COM files in the current directory
whenever a DOS DIR command is executed. Infected .COM files
will have a file length increase of 550 bytes with the virus
being located at the end of the file. The program's date and
time in the DOS disk directory listing will not be altered.
The following text strings are visible within the viral code:
"1 Did David Gerrold have a harley when he was one?"
"2 Is John Brunner a shocking wave rider?"
"3 Is William Gibson a neurotic romantic?"
"4 Is Australian Parasite the Best?"
"1:No, 2:Yes, 3: Probably, 4: Absolutely"
"AP*.COM"
The text string "AP" can be found starting in the fourth byte
of all infected programs. This variant contains destructive
code which overwrites the current drive on the 29th day of a
specific month, though due to a bug in the virus, this code
will not be executed.
Origin: Melbourne, Australia January 1993.
[Previously in VSUM as: Aussie Dir, alias: Sdir]
Aussie Parasite.550.B: Received in January, 1996, this is a
minor variant of the Aussie Parasite.550.A variant. It contains
the following text strings:
"Stupid Directory Virus MK ][ by Aus P. (C) 1992 AP"
"Whelp, here it is folks, the definitive bug free version."
"Yessireebob, fuckings on the 29th February 1993"
"to all who get bitten by SDIR 2. Reled on AARNET, Aust."
"AP*.COM"
The text string "AP" can be found starting in the fourth byte
of all infected programs.
Origin: Unknown January, 1996.
Aussie Parasite.579: Received in January, 1996, this is a 579 byte
variant of the Aussie Parasite virus. Its size in memory is
640 bytes, hooking interrupt 21. It adds 579 bytes to the .COM
programs it infects, the virus being located at the end of the
file. The program's date and time in the DOS disk directory
listing will not be altered. The following text strings are
visible within the viral code in all infected files:
"Exxon Valdez v1.0"
"(C) 1993 Australian Parasite"
"Thats Australian, NOT Austrian"
"Like oil, I smother everything in my path"
"Like oil, It takes decades to fully recover from me"
"Like an oil spill, There is no cure"
"RIP Alaska, RIP Shetland Isles, RIP World"
"OIL*.COM"
Origin: Unknown January 1996.
Aussie Parasite.588: Based on the Aussie Parasite virus described
above, Aussie Parasite.588 is a 588 byte version. Its size in
memory is 672 bytes, hooking interrupt 21. It adds 588 bytes to
the .COM programs it infects, the virus being located at the
end of the file. The following text strings are visible within
the viral code in all infected files:
"My Computer is myself."
"My siamese twin."
"Joined by the fingers."
"Its an extension of my body."
"Speration means death."
"Togertherness is power."
"Together I roam electronic highways and biways"
"Going the wrong way down the one way street"
"Against the flow we are the few"
"Beware children, Beware"
"There is not long to go."
"v0.02 by 烛K + DK [AIH]"
Origin: Unknown January 1995.
Aussie Parasite.591: Based on the Aussie Parasite virus described
above, Aussie Parasite.591 is a 591 byte version. Its size in
memory is 672 bytes, hooking interrupt 21. It adds 591 bytes to
the .COM programs and 591 to 605 bytes to .EXE programs. In
both cases, the virus will be located at the end of the file.
The following text string is visible within the viral code in
all infected files:
"AIH-0"
Origin: Unknown January 1995.
Aussie Parasite.635: Based on the Aussie Parasite virus described
above, Aussie Parasite.635 is a 635 byte version. Its size in
memory is 640 bytes, hooking interrupt 21. It adds 635 bytes to
the .COM programs it infects. The virus will be located at the
the end of the file. The following text strings are visible
within the viral code in all infected files:
"Kevin Mitnick"
"Lenny Dicco"
"Hans Hbner"
"414's"
"Legion of Doom"
"Phiber Optik"
"Dr Popp"
"Robert Morris"
"Shooting Shark"
"Chesire Catalyst"
"Captain Crunch"
"Ron Austin"
"Kevin Poulsen"
"Edward Singh"
"are all to be congratulated"
Origin: Unknown January 1995.
Aussie Parasite.726: Based on the Aussie Parasite virus described
above, Aussie Parasite.726 is a 726 byte version. Its size in
memory is 736 bytes, hooking interrupt 21. It adds 726 bytes to
the .COM programs it infects. The virus will be located at the
the end of the file. The following text strings are visible
within the viral code in all infected files:
"LURKING VIRUS"
"An interactive virus program - a Hackers Haven"
"Copyright (c) 1987 by Infocom, Inc. All rights reserved"
"In collaboration with the Australian Parasite"
"LURKING VIRUS is a trademark of Infocom, Inc."
"Release 63 / Serial number 830503"
"Inside Computer"
"You are sitting on the CPU inside the computer. You can see
the monitor above"
"your head."
"There is a Boot Sector here."
"There is a FAT here."
"There is a Program here.
"I love Anke Huber"
Origin: Unknown January 1995.
Aussie Parasite.762: Based on the Aussie Parasite virus described
above, Aussie Parasite.762 is a 762 byte version. Its size in
memory is 1,024 bytes, hooking interrupt 21. It adds 762 bytes
to the .COM programs it infects. The virus will be located at
the the end of the file. The following text strings are
visible within the viral code in all infected files:
"(C) 1993 AIH; Australian Institute of Hackers."
"Greets to PuKE, SCP and fellow Aussie viral creators"
"You help us to keep the Australian end of the virus
underground alive."
"I need to go to the Jon. More Coffee anyone."
"You Pat the rich huh, Hey man I prefer the poor."
"You Frigid Skilless son, of mine, won't even feel her up
will ya."
"Lets go to the Mall and look for Fergie's son."
"Its a Cross between an iceberg and cow manure."
"January, February, March, April, you can't make a tapestry
with a staple."
"I'm Cold and Feeble."
Origin: Unknown January 1995.
Aussie Parasite.784: Based on the Aussie Parasite virus described
above, Aussie Parasite.784 is a 784 byte version. Its size in
memory is 800 bytes, hooking interrupt 21. It adds 784 bytes to
the .COM programs it infects, the virus being located at the end
of the file. The following text strings are visible within the
viral code in all infected files:
"1. Thou shalt spread viruses"
"2. Thou shalt be origional"
"3. Thou shall not create a variant of anothers virus"
"4. Though shall put witty phrases in ones code"
"5. Though shall not destroy code"
"6. Thou must love Tonya Harding"
"7. Thou must love Anke Huber"
"8. Thou must condemn any virus writter brought to trial"
"9. All text must be in flowing English (Asians take note)"
"0. Its easier to write a Boot Sector virus than a resident
virus"
"Anke Huber is the best tennis player in the world."
"says the Australian Parasite."
Origin: Australia October 1994.
Aussie Parasite.990: Based on the Aussie Parasite virus described
above, Aussie Parasite.990 is a 990 byte version. Its size in
memory is 1,964 bytes, hooking interrupt 21. It adds 990 bytes
to the .COM programs it infects, the virus being located at the
end of the file. The following text strings are encrypted
within the viral code:
"The Digitised Parasite : Australian Parasite [AIH]"
"Weiners XOR machine 1.0"
"(C) Australian Parasite [AIH] June 1994"
The following text string can be found unencrypted at the very
end of all infected files:
"Australian Parasite"
Origin: Unknown January 1996.
Aussie Parasite.1041: Based on the Aussie Parasite virus
described above, Aussie Parasite.1041 is a 1,041 byte version.
Its size in memory is 2,112 bytes, hooking interrupt 21. It
adds 1,041 bytes to the .COM programs it infects, the virus
being located in the middle of the file. The following text
strings are visible within the viral code in all infected files:
"Greets to you from Cyber Crack and Dark Fiber of the"
"Australian Institute of Hackers"
"Were just here to say what a wank-stain of a lame arse
faggot you are"
"Greets to our AIH bretheren, NEUA, RABID, NuKE, PuKE, SCI"
"LOL: It ain't goot to steal credit for things you didn't do.
Fuck with us"
"and we'll fuck you right over reaaaaal gooood"
"George Thorogood: Luv ya new song, Get a Haircut and Get a
real Job"
"Morib Angel+Diamand Galas+Pestilence+Canibal Corpse=Me
mum with PMT:"
Origin: Australia October 1994.
Aussie Parasite.1050: Based on the Aussie Parasite virus
described above, Aussie Parasite.1050 is a 1,050 byte version.
Its size in memory is 1,312 bytes, hooking interrupt 21. It
adds 1,050 bytes to the .COM programs it infects, the virus
being located at the end of the file. The following text
strings are visible within the viral code:
"JUDY.COM"
"Judy Scroller by AP ;)"
"Whoa Judy, Wot I would not give to have a taste of you."
Origin: Unknown January 1995.
Aussie Parasite.1169: Based on the Aussie Parasite virus
described above, Aussie Parasite.1169 is a 1,169 byte version.
Its size in memory is 7,104 bytes, hooking interrupt 21. It
adds 1,169 bytes to the .COM programs it infects, the virus
being located in the middle of the file. The following text
strings are visible within the viral code in all infected files:
"SCP, What friggen lamers, Can you folks write anything else
besides"
"Overwriting or Vienna variant viruses."
"TPE is better than MTE"
"Brainnsssss, Brainnssssss,"
"When there is no more room in HELL,"
"The dead will walk the EARTH."
"(C) George A. Romero"
"Count Zero die in the sprawl."
"Ahh.. The joys of safe hex"
"Its not my fault. Its all those horror movies and death
metal music."
"Try to get past logging in,"
"Put another password in,"
"Bomb it out and try again."
"We're Hacking, Hacking, Hacking."
"Try his first wifes maiden name,"
"This is more than just a game."
"But there again, its all the same."
"Its Hacking, Hacking, Hacking."
"People who use the VCL and PS-MPC are bigger lamers than SCP."
"This virus was written by Jack Kenyon to test out
Virus Buster."
"Phone (07) 343 8866 in Australia if you have any problems."
Origin: Australia October 1994.
Aussie Parasite.1179: Based on the Aussie Parasite virus
described above, Aussie Parasite.1179 is a 1,179 byte version.
Its size in memory is 1,184 bytes, hooking interrupt 21. It
adds 1,179 bytes to the .COM programs it infects, the virus
being located in the end of the file. The following text
strings are visible within the viral code:
"Anke Huber 2"
"Decembernke Huber 2"
"C'mon Anke Huber. Kick everyones butt on your way to claim
the winners cheque"
"The Australian Open at Flinders Park, January 18 to 31st"
"Australia is also home to the Australian Parasite"
"The French Open at some crap clay court in France, May 24th
to June 7th"
"France, home to the black electroid out of Buckaroo Banzai,
Yannick Noah"
"Wimbledon. A great pommy affair on a grass court, June 21st
to September 4th"
"England is home to the Queen and the birthplace of tennis"
"The multimillion dollar ATP and Virginia Slims Championships."
"Only for the elite. November 15th to 29th"
"The US open, August 30th to September 13th"
"Hasn't Jennifer Capriati burnt out ye"
The first text string above will occur near the beginning of
all infected files, while the other text strings will be
near the end of the file.
Origin: Unknown January 1995.
Aussie Parasite.AMSV: Based on the Aussie Parasite virus described
above, Aussie Parasite.AMSV is a 443 byte variant. Its size in
memory is approximately 448 bytes, hooking interrupt 21. It
adds 443 bytes to the .COM programs it infects on execution.
The virus will be located at the end of all infected files. The
following text strings are visible within the viral code in all
infected programs:
"APMSAV"
"Eli & Yuval were here and killed the Lehigh !!!"
"The Anti-MicroSoft Virus (AMSV) v1.0"
"By Yuval Sherman & Eli Shapira.... Revenge against Microsoft."
Origin: Unknown January, 1995.
Aussie Parasite.Comic: Based on the Aussie Parasite virus
described above, Aussie Parasite.Comic is a 1,068 byte version.
Its size in memory is 1,072 bytes, hooking interrupt 21. It
adds 1,068 bytes to the .COM programs it infects on execution.
The virus will be located at the end of all infected files. The
following text strings are visible within the viral code in all
infected programs:
"COMIC RELIEF VIRUS"
"Never calls itself a 'virus,' but instead refers to itself"
"as an 'electronic microorganism.' Infected machines stop
working"
"and display 'computationally challenged.'"
"Government Economist Virus"
"Nothing works but diagnostic software reports is everything
is fine."
"Federal Bureaucrat Virus"
"Divides the hard disk into hundreds of little units, each of
which"
"does nothing at all, but claims to be the most important."
"Federal Budget Virus"
"Attempts to allocate non-existent memory to programs. When
detected"
"it passes control to the IRS virus."
"IRS Virus"
"Immediatley locks up"
"it wants to."
"Paul Revere Virus"
"This virus warns you of an attack, Once by LAN, twice if by
C.MI"
Origin: Unknown January, 1995.
Aussie Parasite.Gotter: Based on the Aussie Parasite virus
described above, Aussie Parasite.Gotter is a 1,024 byte
version. Its size in memory is 1,088 bytes, hooking interrupts
13 and 21. It adds 1,024 bytes to the .COM programs it infects
on execution, open, or copy, the virus being located at the end
of the file. The following text strings are visible within
the viral code in all infected programs:
"GOTTERDAMERUNG: Silicon Valley: The Next Golgotha"
"hey PuKE keep up or fall behind"
"Drk r [AIH]"
This variant also alters the disk boot sector, and may interfer
with DOS DIR commands when issued against a write protected
diskette.
Origin: Unknown July 1994.
Aussie Parasite.Lipo: Based on the Aussie Parasite virus
described above, Aussie Parasite.Lipo is a 290 byte variant.
Its size in memory is 304 bytes, hooking interrupt 21. It adds
290 bytes to the .COM programs it infects on execution. The
virus will be located at the end of the file. The following
text string is visible within the viral code:
"I'm going to liposuck the FAT out of your hard disk."
Origin: Unknown January 1995.
Dorn: Based on the Aussie Parasite virus described above,
Dorn is a 377 byte version. Its size in memory is 448 bytes,
hooking interrupt 21. Dorn adds 377 bytes to the .COM
programs it infects, the virus being located at the end of the
file. The following text strings are visible within the viral
code in all infected programs:
"Kill Dorn W. Stickle"
"(C) 1992 Australian Parasite"
Origin: Australia January 1993.
Elvirus: Based on the Aussie Parasite virus described above,
Elviris is a 369 byte version. Unlike Assie Parasite, it is
a direct action infector of .COM programs, including
COMMAND.COM. Elvirus infects the first .COM program in the
current directory each time an infected program is executing,
adding 369 bytes to the program's length. Elvirus is unable
to determine when the program was previously infected, it will
reinfect programs many times. The Elvirus virus may display
the following message on the top portion of the system
monitor when an infected program is executed in the evening:
"Night of the Living Virus
Concept: Elvirus Misstress of the Dark Assembler
Programming: Australian Parasite (Enough said)
Loves to Tonya H and Dianna G"
The above text strings are visible within the viral code in
Elvirus infected programs. The following additional text
string is also visible:
"*.COM"
Origin: Australia January 1993.
Grue: Based on the Aussie Parasite virus described above,
Grue is a 338 byte version. Its size in memory is 400 bytes,
hooking interrupt 21. Grue adds 338 bytes to the .COM
programs it infects, the virus being located at the end of the
file. The following text strings are visible within the viral
code in all infected programs:
"It is pitch black. You are likely to be eaten by a Grue."
Origin: Australia January 1993.
See: Kuang