Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically


Smeg is not a virus it is a polymorphic library that can be attached to any virus. Virus modified in this way cannot be detected by a string. Smeg is short for Simulated Metamorphic Encryption Generator. It was written in England by the author using nickname Black Baron. There are three versions of Smeg. They differ in instructions used as “rubbish”, i.e. not influencing the flow of the code but increasing its variability.

Smeg.Pathogen, Smeg.Queeg
These are polymorphic, resident COM and EXE infectors. COMMAND.COM as well as some anti-virus programs will not be attacked. Both these viruses are destructive and they corrupt data on hard disk. Smeg.Pathogen gets activated on Mondays, Smeg.Queeg on Sundays. At their activity the viruses write the following texts:

Your hard-disk is beeing corrupted, courtnesy of PATHOGEN!
Programmed in the U.K. (Yes, NOT Bulgaria) [C] The Black Baron 1993-4.
Featuring SMEG v0.1: Simulated Metamorphic Encryption Generator!
'Smoke me a kipper, I`ll be back for breakfast.....'
Unfortunately, some of your data won`t!!!!!

- -» QUEEG «- -
- ~~~~~ -
-(C)The Black Baron 1994 -
- -
- Featuring: SMEG v0.2 -
- -
- Better than life..... -

This is a simple, direct action COM infector written as a demo virus to Smeg_v0.3. It attacks COM type programs in the current directory if their attribute is not set to Read only. Virus uses this attribute to mark already infected files. If an infected program is executed on the 13th day of a month and this day is Friday the virus will present itself by writing the following text:

This program requires Microsoft Windows

and the infected program will not be executed.
The author of SMEG was identified and sentenced to prison for 18 months.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.