Selected viruses, spyware, and other threats: sorted alphabetically
Pojer.1919, Pojer.1935, Pojer.1941, Pojer.1949
These are resident encrypted COM and EXE infectors. They infect files only when they are executed. All variants of the virus use for their identification in memory calling of additional, in all cases identical sub-function INT 21h. On odd days of months February, July, September and December the viruses will install their own INT 1Ch service. The variant Pojer.1949 does this also in June, but in September only up to the 19th. On the above mentioned days the virus will display a blinking square in the top left corner of the screen. On February 6th and November 17th the viruses at their installation into memory will display a piece of text. With the variant Pojer.1919 it will be the following text:
** B R A I N 2 v1.40 **
WARNING ! Your PC has been WANKed !
>> 17.11.1989 <<
Viruses against political extremes , for freedom and parliamentary democracy.
>> STOP LENINISM , STOP KLAUSISM , STOP BLOODY DOGMATIC IDEOLOGY !! <<
- for John McAfee: John,your SCAN = good program.
- for CN and his company: Boys,the best ANTI-VIRUSES are Zeryk,Saryk and Vorisek !
- for F : Girls are better than computers and programming !
This program is copyright by SB SOFTWARE All rights reserved.
O.K. Your PC is now ready !
Text of variants Pojer.1935 and Pojer.1941 is slightly different – they announce themselves as BRAIN2 v1.00. The variant Pojer.1949 identifies itself as BRAIN2 v1.60 and it does not contain the message on copyright and readiness of the computer.
This is a resident, polymorphic, stealth COM and EXE infector. Upon its installation into memory it tries to deactivate the resident protection VSAFE and utility NOHARD and NOFLOPPY. It redirects the interrupt INT 21h to its body in the memory. The virus infects appropriate files as they are executed and created. It marks them in the following way: to the year of the file origin it adds 100 years and sets the value of seconds to 0. If the virus is present in memory no increase in length of infected files nor alternation in the date of their origin can be seen. On odd days of months January, September and November the virus installs its own INT 1Ch service. As a result a blinking square is displayed in the top left corner of the screen. If the system date is set on February 6th or November 17th the virus displays the following text, accompanied by beeping sound of the speaker:
** BRAIN2 v.2.00beta - upgrade from POJER **
BETA tester, thank you, .. have a nice day in cyberspace ...
This crazy program is (c) 12/93 by SB
© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.