Conjurer Virus


 Virus Name:  Conjurer 
 Aliases:     Conjurer.181 
 V Status:    New 
 Discovery:   January, 1996 
 Symptoms:    .COM file growth; file date/time changes 
 Origin:      Unknown 
 Eff Length:  181 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method: NAV, NAVDX, IBMAV, PCScan, AVTK, ViruScan, F-Prot, 
                   ChAV, 
                   NAV/N, IBMAV/N, AVTK/N, LProt, NShld, Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Conjurer or Conjurer.181 virus was received with several variants 
       in January, 1996.  Their origin or point of isolation is unknown. 
       Conjurer.181 is a non-resident, direct action infector of .COM 
       files, including COMMAND.COM. 
 
       When a program infected with the Conjurer.181 virus is executed, 
       this virus will infected up to five .COM files located in the 
       current directory.  Infected .COM files will have a file length 
       increase of 181 bytes with the virus being located at the end of the 
       file.  The file's date and time in the DOS disk directory listing 
       will have been updated to the current system date and time when 
       infection occurred.  The following text string is visible within 
       the viral code in all infected programs: 
 
           "*.COM" 
 
       Additionally, the text string "GN" can be found starting in the 
       fourth byte and at the very end of all infected files. 
 
       Known variant(s) of Conjurer are: 
       Conjurer.265: Also received in January, 1996, this is a 265 byte 
           variant of the Conjurer virus described above.  It infects the 
           first five .COM files in the current directory if they were not 
           previously infected by this variant.  It does not infect past 
           the first five .COM files in any directory.  Infected files will 
           have a file length increase of 265 bytes with the virus being 
           located at the end of the file.  The program's date and time in 
           the DOS disk directory listing will have been updated to the 
           current system date and time when infection occurred.  The 
           following text strings are visible within the viral code: 
           "z.com" 
           "iMMoRTaL.263!!" 
           This variant displays the last text string indicated above as 
           a message when an infected program is executed.  System hangs 
           may occur when infected programs are executed. 
           Origin:  Unknown  January, 1996. 
       Conjurer.270: Also received in January, 1996, this is a 270 byte 
           variant of the Conjurer virus described above.  It infects the 
           first five .COM files in the current directory if they were not 
           previously infected by this variant.  It does not infect past 
           the first five .COM files in any directory.  Infected files will 
           have a file length increase of 270 bytes with the virus being 
           located at the end of the file.  The program's date and time in 
           the DOS disk directory listing will have been updated to the 
           current system date and time when infection occurred.  The 
           following text strings are visible within the viral code: 
           "CoNJuReR.BSC!" 
           "*.com" 
           This variant displays the first text string indicated above as 
           a message when an infected program is executed.  System hangs 
           may occur when infected programs are executed. 
           Origin:  Unknown  January, 1996. 
       Conjurer.277: Also received in January, 1996, this is a 277 byte 
           variant of the Conjurer virus described above.  It infects the 
           first five .COM files in the current directory if they were not 
           previously infected by this variant.  It does not infect past 
           the first five .COM files in any directory.  Infected files will 
           have a file length increase of 277 bytes with the virus being 
           located at the end of the file.  The program's date and time in 
           the DOS disk directory listing will have been updated to the 
           current system date and time when infection occurred.  The 
           following text strings are visible within the viral code: 
           "*.COM" 
           "Dismezzie iz printed by:" 
           "CoNJuReR.TNG (The Next Generation!)" 
           The text string "GN" can be found starting in the fourth byte of 
           all infected files.  This variant may display the last two text 
           strings indicated above as a message when an infected program is 
           executed.  System hangs may occur when infected programs are 
           executed. 
           Origin:  Unknown  January, 1996. 
       Conjurer.300: Also received in January, 1996, this is a 300 byte 
           variant of the Conjurer virus described above.  It infects up to 
           five .COM files in the current directory when an infected program 
           is executed.  Infected files will have a file length increase of 
           300 bytes with the virus being located at the end of the file. 
           The program's date and time in the DOS disk directory listing 
           will have been updated to the current system date and time when 
           infection occurred.  The following text strings are encrypted 
           within the viral code: 
           "*.com" 
           "CoNJuReR.300!" 
           This variant may display the last text string indicated above as 
           a message when an infected program is executed.  System hangs may 
           occur when infected programs are executed. 
           Origin:  Unknown  January, 1996. 
       Conjurer.312: Also received in January, 1996, this is a 312 byte 
           variant of the Conjurer virus described above.  It infects up to 
           five .COM files in the current directory when an infected program 
           is executed.  Infected files will have a file length increase of 
           312 bytes with the virus being located at the end of the file. 
           The program's date and time in the DOS disk directory listing 
           will have been updated to the current system date and time when 
           infection occurred.  The following text strings are encrypted 
           within the viral code: 
           "*.COM" 
           "GN" 
           "Diz mezzie iz printed by:" 
           "CoNJuReR.TNG" 
           "CoNJuReR.TNG (The Next Generation!)" 
           The unencrypted text string "GN" can be found starting in the 
           fourth byte of all infected files.  This variant may display the 
           following message when an infected program is executed: 
           "Diz mezzie iz printed by: 
            CoNJuReR.TNG! (The Next Generation!)" 
           System hangs may occur when infected programs are executed. 
           Origin:  Unknown  January, 1996. 
       Conjurer.353: Also received in January, 1996, this is a 353 byte 
           variant of the Conjurer virus described above.  It infects up to 
           five .COM files in the current directory when an infected program 
           is executed.  Infected files will have a file length increase of 
           353 bytes with the virus being located at the end of the file. 
           The program's date and time in the DOS disk directory listing 
           will have been updated to the current system date and time when 
           infection occurred.  The following text strings is visible within 
           the viral code: 
           "z.com" 
           The following text string may be encrypted or unencrypted within 
           viral code in all infected programs: 
           "iMMoRTaL.358!!" 
           This variant may display the last text string indicated above as 
           a message when an infected program is executed, in either 
           encrypted or unencrypted form.  System hangs may occur when 
           infected programs are executed. 
           Origin:  Unknown  January, 1996. 
       Conjurer.377: Also received in January, 1996, this is a 377 byte 
           variant of the Conjurer virus described above.  It infects up to 
           five .COM files in the current directory when an infected program 
           is executed.  Infected files will have a file length increase of 
           377 bytes with the virus being located at the end of the file. 
           The program's date and time in the DOS disk directory listing 
           will have been updated to the current system date and time when 
           infection occurred.  The following text strings are encrypted 
           within the viral code: 
           "z.com" 
           "iMMoRTaL.377  {Encrypted!!}" 
           This variant may display the last text string indicated above as 
           a message when an infected program is executed.  System hangs 
           may occur when infected programs are executed. 
           Origin:  Unknown  January, 1996. 
       Conjurer.408: Also received in January, 1996, this is a 408 byte 
           variant of the Conjurer virus described above.  It infects up to 
           five .COM files in the current directory when an infected program 
           is executed.  Infected files will have a file length increase of 
           408 bytes with the virus being located at the end of the file. 
           The program's date and time in the DOS disk directory listing 
           will have been updated to the current system date and time when 
           infection occurred.  The following text strings are encrypted 
           within the viral code: 
           "DEBUGGING IS VERY ILLEGAL (NOT!)" 
           "Test Virus #2 Hacking Hell I-EAS Virus Creation Centre v0.19" 
           "[T2] [HH] [IE-VCC v0.19]" 
           "COM" 
           This variant does not display any messages, and system hangs do 
           not occur. 
           Origin:  Unknown  January, 1996. 
       Conjurer.433: Also received in January, 1996, this is a 433 byte 
           variant of the Conjurer virus described above.  It infects up to 
           five .COM files in the current directory when an infected program 
           is executed.  Infected files will have a file length increase of 
           433 bytes with the virus being located at the end of the file. 
           The program's date and time in the DOS disk directory listing 
           will have been updated to the current system date and time when 
           infection occurred.  The following text strings are encrypted 
           within the viral code: 
           "*.com" 
           "Ajax is kampioen, Ajax blift kampioen, 
            er is nog geen club die daar iets aan kan doen! 
            CoNJuReR.AJAX Rulez! [iMMoRTaL EAS] 
            Ajax won UEFA-Cup 1995!!!" 
           This variant displays the last text string indicated above as a 
           message whenever an infected program is executed. 
           Origin:  Unknown  January, 1996. 
       Conjurer.506: Also received in January, 1996, this is a 506 byte 
           variant of the Conjurer virus described above.  It infects all of 
           the .COM files in the current directory when an infected program 
           is executed.  Infected files will have a file length increase of 
           506 bytes with the virus being located at the end of the file. 
           The program's date and time in the DOS disk directory listing 
           will have been updated to the current system date and time when 
           infection occurred.  The following text strings are encrypted 
           within the viral code: 
           "DEBUGGING IS VERY ILLEGAL (NOT!)" 
           "Mega Destruct Hacking Hell I-EAS Virus Creation Centre v0.19" 
           "[MD] [HH] [IE-VCC v0.19] 
           "COM" 
           This variant displays the following message whenever an infected 
           program is executed: 
           "You computher is now infected with: 
                 MEGA-DESTRUCTION 
               The Conjurers...." 
           Origin:  Unknown  January, 1996. 
       Conjurer.510: Also received in January, 1996, this is a 510 byte 
           variant of the Conjurer virus described above.  It infects up to 
           five .COM files in the current directory when an infected program 
           is executed.  Infected files will have a file length increase of 
           510 bytes with the virus being located at the end of the file. 
           The program's date and time in the DOS disk directory listing 
           will have been updated to the current system date and time when 
           infection occurred.  The following text strings are encrypted 
           within the viral code: 
           "iMMoRTaL.510 {Encrypted!!}" 
           "*.com" 
           This variant may display the first text string indicated above as 
           a message when an infected program is executed.  System hangs 
           may occur when infected programs are executed. 
           Origin:  Unknown  January, 1996. 
       Conjurer.550: Also received in January, 1996, this is a 550 byte 
           variant of the Conjurer virus described above.  It infects up to 
           five .COM files in the current directory when an infected program 
           is executed.  Infected files will have a file length increase of 
           550 bytes with the virus being located at the end of the file. 
           The program's date and time in the DOS disk directory listing 
           will have been updated to the current system date and time when 
           infection occurred.  The following text strings are visible 
           within the viral code: 
           "z.com" 
           "anti-vir.dat" 
           "c:\dos\keyb.com" 
           "c:\dos\doskey.com" 
           "c:\run-me.com" 
           This variant also infects the copies of KEYB.COM and DOSKEY.COM 
           located in the C: drive DOS directory, as well as creating a 31 
           byte file with the current system date and time in the C: drive 
           root directory.  Once all of the .COM files in the current 
           directory have been infected by the virus, it will display the 
           following message: 
           "iMMoRTaL.550!!" 
           System hangs may occur when infected programs are executed. 
           Origin:  Unknown  January, 1996. 
       Conjurer.586: Also received in January, 1996, this is a 586 byte 
           variant of the Conjurer virus described above.  It infects up to 
           five .COM files in the current directory when an infected program 
           is executed.  Infected files will have a file length increase of 
           586 bytes with the virus being located at the end of the file. 
           The program's date and time in the DOS disk directory listing 
           will have been updated to the current system date and time when 
           infection occurred.  The following text strings are encrypted 
           within the viral code: 
           "DEBUGGING IS VERY ILLEGAL (NOT!)" 
           "Test Virus #3 Hacking Hell I-EAS Virus Creation Centre v0.19" 
           "[T3] [HH] [IE-VCC v0.19]" 
           "COM" 
           This variant corrupts CMOS by uninstalling all drives and resets 
           the system date and time to Saturday, August 07, 1909. 
           Origin:  Unknown  January, 1996. 
       Conjurer.886: Also received in January, 1996, this is an 886 byte 
           variant of the Conjurer virus described above.  It infects up to 
           five .COM files in the current directory when an infected program 
           is executed.  Infected files will have a file length increase of 
           886 bytes with the virus being located at the end of the file. 
           The program's date and time in the DOS disk directory listing 
           will have been updated to the current system date and time when 
           infection occurred.  The following text strings maybe visible 
           or encrypted within the viral code: 
           "DEBUGGING IS VERY ILLEGAL (NOT!)" 
           "????????SYS" 
           "I am an assasin, I want to and shall kill you!" 
           "I also hate Aladdin and will also kill it!" 
           "I will eliminate you with the touch of just one finger" 
           "Look at my revenge! Crying wont help you!" 
           "I am a dangerous virus, I live! I am created by:" 
           "The   [HACKING HELL] !!!!" 
           "Fear me! I am more powerfull than GOD!" 
           "Aladdin Killer #1 Hacking Hell" 
           "I-EAS Virus Creation Centre v0.19" 
           "[AK]" 
           "[HH]" 
           "[IE-VCC v0.19" 
           "XXX-Rated$+.COM" 
           Origin:  Unknown  January, 1996. 

Show viruses from discovered during that infect .

Main Page