Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

Deliver

Deliver.1771

This is a memory resident EXE infector coming from Poland. When an infected file is executed the virus becomes memory resident below the 640 KB boundary. It moves its body to the interrupt INT 21h. The virus attacks files when they are opened and when their attributes or name are changed. It attacks files larger than 10 KB and smaller than 400 KB. The virus attaches itself to the end of the file, modifies the file size to a multiple of 16, and sets the seconds at the time of file origin to 60. Increase in the file length is concealed. After the program MKS_VIR is executed or the vector of the interrupt INT 1 (single step) is changed the virus removes itself from memory and, in addition, rewrites the area he was located at by zeros. If the system date is November 1st the virus overwrites a part of the disk by the following text which is repeated:

! MAYBE ONE DAY WE BE UNITED !

After that the virus draws the US flag, plays the anthem and writes the following text:

!!! MY NAME IS DISKDELIVER * THIS IS ONLY BEGIN * I BE BACK !!!

In the very end the virus resets the computer. The virus code contains also text announcing who is the author as well as when and where the virus was made.

Deliver.3547

Unlike its foregoer from the year 1994, this virus is polymorphic. It attacks COM and EXE type files when they are executed or closed after being worked with. This virus, as its foregoer, sets the value of seconds at the time of file origin to 60. It conceals this alternation as well as the increase in the file length. From May 28th to May 30th it overwrites a part of the hard disk by the string DIGI POWER. After that the same string is written on the screen in graphic mode, upon the background of moving colourful lines. This activity is accompanied by music from a movie. There is a strip with the following text on the bottom edge of the screen:

THIS IS A NEW ...DELIVER II Steath (R) WRITE BY DiGiT! ...SOUTH POLAND 1995

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.