Grog.28
Details
Grog.283
Grog.283
This is a relatively harmless non-memory resident parasitic virus. Upon execution, it searches for .COM-files of the current directory and writes itself to their beginnings. This virus contains the internal strings:
>>1/93<<
Nocciola Vildibranda Crapomena
NOCCIOLA (C) '93 by Grog - Italy
Grog.304
This is a benign non-memory resident parasitic virus. Upon execution, it infects COMMAND.COM files on A: and C: drives. It overwrites the last 304 bytes of these files ("Lehigh" algorithm), so the file length on infection does not grow. This virus contains the internal string ":\COMMAND.COM", and sometimes displays another string:
DELIRIOUS (C) '93 by GROG - Italy
Grog.377
This is a benign non-memory resident overwriting virus. Upon execution, it reads a randomly selected sector of the floppy disk and checks its beginning for the JMP or CALL instruction (E9h or E8h). If this instruction exists, the virus overwrites the part of this sector with the virus code. Upon reading/writing, the virus uses INT 40h calls by BIOS address. Upon a reading/writing error, it displays the following message:
"Il nostro amore durera' per sempre", disse lui.
"Oh, si, si, si!", esclamo' lei.
"Intendendo 'sempre' in senso relativo, pero'", disse lui.
Lei lo colpi' con una racchetta da sci.
It contains an internal string also:
_Sempre_(C)_'93_by_Grog_Italy_
Grog.202,456
These are dangerous non-memory resident overwriting viruses. They search for .COM-files of the current directory and overwrite them. If there are no *.COM-files in the current directory, "Grog.202" displays the string "TRUMPERY (C) '93 by GROG" and dials a randomly selected phone number by modem (if it exists). This virus contains an internal text also: "ATD020000000".
"Grog.456" contains a lot of internal text strings "GROG" and
>>11/92<<
Mormorio (C) '92 by GROG - Italy
It also displays:
Joe Mormorio e i suoi fratelli erano borsaioli.
Battevano tutte le fiere della contea.
Come faceva la gente a accorgersi di essere stata borseggiata?
Quando un Mormorio correva tra la folla.
Grog.474
This is a dangerous non-memory resident parasitic virus. It searches for .COM-files of the current directory and inserts itself into these files. Upon infection, this virus overwrites the part of code which contains zero bytes or text strings. Usually these files work correctly, but in some cases, they hang the computer up. Depending on the current value of the system timer, this virus erases the screen by the '*' character. It also contains the internal strings:
>>3/93<<
*.COM
Bruchetto (C) '93 by Grog - Italy
Grog.480
This is a benign non-memory resident parasitic virus. It searches for COM-files of floppy disks and inserts itself into the file's middle. The virus searches for the file data which contains 480 constant bytes, then it stores that byte and overwrites this area by itself. Upon execution, the virus restores that area; and upon infection, this virus hooks INT 40h (Relocated Floppy handler), and checks the addresses of the sectors read from disk. Upon writing to a file, the virus uses INT 40h calls. The virus contains the internal text string:
HopHopHop (c) '93 By GROG - Italy
"Guida alla Corsa"
Capitolo primo
Come correre al modo dei conigli.
Hop Hop Hop
Hop Hop Hop
Grog.488
This is a benign non-memory resident parasitic virus. It searches for .EXE-files of the current directory and insert itself into their headers (if there are free space). It contains the internal strings:
*.EXE
>>2/93<<
ENMITY v1.0 (C) '93 by GROG - Italy
G G
R +-- R
O ?-- O
G +--nmity G
Grog.495
This is a benign non-memory resident parasitic virus. It searches for .COM-files of the current directory and writes itself to their beginnings. Sometimes it changes the current video font. It also contains the internal strings:
Gg CHAR2GROG (C) '93 by GROG - Italy
*.com
GROG FOR EVER
Grog.512
This is a benign memory resident parasitic virus. It hooks INT 21h, and infects EXE-files upon accessing to them. It inserts itself into their headers (if there is free space). It contains the internal strings:
ENMITY v2.0 (C) '93 by GROG - Italy
>>3/93<<
+--
?--
+--nmity by GROG
"Grog.512.b" is the encrypted virus, it contains the internal texts:
ENMITY v2.1 (C) '93 by GROG - Italyü
>>7/93<<
Grog.518,886
These are benign non-memory resident parasitic encrypted viruses. Upon execution, they search for executable files of the current directory and write themselves to their ends. "Grog.518" hits .COM-files, and "Grog.886" hits EXE-files only. Upon infection, they use System File Tables. Sometimes they display random characters. These viruses also contain the internal string:
"Grog.518": OUTWIT-C (C) '93 by GROG - Italy
"Grog.886": OUTWIT-E (C) '93 by GROG - Italy
Grog.547,566
These are benign non-memory resident parasitic viruses. Upon execution, they search for .COM-files of the current directory and write themselves to their ends. These viruses contain the internal strings:
"Grog.547":
Villino (C) '93 by GROG - Italy
"Non hai mantenuto la promessa", ella disse.
"Quando ti ho sposato, hai detto che avremmo
abitato in un villino coperto di fronde."
"D'accordo! D'accordo!", grido' lui.
"Rivolgiti alla Commissione Urbanistica!"
"Grog.566":
}}}- LaTraviata (C) '93 by GROG - Italy -{{{
-----------------------------------------------------
Il suo vero nome era Lavinia Traviata.
Ma tutti i suoi amici la chiamavano "La".
Per cui, spesso veniva indicata come "La Traviata".
-----------------------------------------------------
Grog.557
This is a dangerous non-memory resident overwriting virus. Upon execution, it searches for .COM and .EXE-files of the current directory and overwrites them. This virus contains the internal string:
>>1/92<<
MILA (c) 1992 by GROG - Italy
It displays messages:
MILA BY NIGHT on radio DEEJAY!!! 24:00-2:00
Illegal copy
Grog.647,660
These are dangerous non-memory resident parasitic viruses. They search for COM-files beginning from JMP instruction (E9h) and write themselves to files ends. Upon infection, the viruses overwrite the part of code at the file end. These files can be corrupted in this way. The viruses use the System File Table upon file accessing. On June 15th ("Grog.647") or May 15th ("Grog.660"), the viruses leave a TSR program in memory hooking INT 1Ch and 21h. This program checks the DOS prompt input, and upon execution of the file with the name GROG, the viruses display the following:
"Grog.647": Aver Torto
"Grog.660": Il Mostro
Depending on their internal counter (in INT 1Ch routine), the viruses display the same string. On other days in May and June, these viruses display the following messages:
"Grog.647": -=[ Aver Torto (C) '93 by Grog - Italy ]=-
"Grog.660": -=< Il Mostro (C) '93 by Grog - Italy >=-
They also contain the internal text string:
“Grog.647″: “Vi E’ Mai Venuto In Mente Che Potreste Aver Torto ?”
“Grog.660″: Il Mostro e i Coniglietti
Storia di terrore e di ansia
“Boo!”, disse il Mostro.
Grog.666
This is a dangerous memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of COM- and EXE-files that are executed. On November 26th, it displays the following message: “LOR (C) ‘93 by GROG Italy” and hangs up the computer . This virus also contains the internal strings:
>>1/93<<
_/\?.?/\_
!?GROGT4TEVER?!
Grog.757
This is a benign non-memory resident parasitic virus. It searches for EXE-files of the current directory, and writes itself to their ends. Upon infection, it uses the System File Tables. Depending on the current time, this virus displays the message "SWAY (C) '93 by GROG - Italy" and then leaves a small memory resident program, which hooks INT 1Ch and sometimes fools with keyboard flags.
Grog.765
This is a memory resident parasitic virus. It hooks INT 21h, and infects COM-files upon accessing them. It writes itself to the end of the files. If one types 'GROG' by argument of the infected program, the virus will display:
Il Grog e' un miscuglio segreto che contiene una o piu' di queste sostanze:
CHEROSENE
GLICOL PROPILENE
DOLCIFICANTI ARTIFICIALI
ACIDO SOLFORICO
RUM
ACETONE
COLORANTE ROSSO n.2
DETRITI
GRASSO PER MOTORE
ACIDO PER LA BATTERIA
E/O PEPERONE
The virus also contains the internal string: "!! MISCUGLIO (C) '93 by GROG - Italy !!".
Grog.794,796 and Grog.1082
"Grog.794,796" are benign non-memory resident parasitic viruses. They search for .COM-files, and write themselves to their ends. "Grog.796" contains the internal text strings:
/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ "Non so dirti quanto ti amo", disse lui. /
/ "Prova", disse lei. \ "Ti voglio molto bene", disse lui. /
/ "Non c'e' male", disse lei. \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
>-< NonCEMale (C) '93 by GROG - Italy >-<
If an infected file is changed (by another virus, for example), "Grog.794" displays the following warning message:
Self Integrity Check warning - File was changed!
Choose an option:
[R] Self Reconstruction.
[C] Continue execution.
[E] Exit to DOS.
Press R,C or E:
and returns to DOS upon answering 'E', continues the program execution upon 'C', or restores the host file upon 'R'. This virus also contains the internal strings:
G*SAV v1.0 (C) '93 by GROG - Italy
>>2/93<<
Grog*Soft Anti-Virus v1.0 (C) '93 by GROG - Italy
"Grog.1082" is practically the same as "Grog.794", but it also infects .EXE-files. Upon infection, they are converted to COM-format (see "Vacsina" viruses). This virus displays:
Self Integrity Check warning - File was changed!
Choose an option:
[R] Self Reconstruction.
[C] Continue execution.
[E] Exit to DOS.
Press R,C or E:
It also contains the text:
G*SAV v1.1 (C) '93 by GROG - Italy
>>3/93<<
Grog*Soft Anti-Virus v1.1 (C) '93 by GROG - Italy
Grog.902
This is a benign memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of .COM- and EXE-files that are accessed. On the 23rd of every month, it displays the following message:
Sua moglie aveva sempre odiato il lavoro di lui.
"Non farai mai i soldi costruendo modellini di velieri", si lagnava.
"Al contrario", dichiaro' lui. "I miei affari vanno a gonfie vele!"
Lei lo inceneri' col tostapane elettrico.
It also contains the internal text strings:
.oO( GonfieVele (C) '93 by GROG - Italy )Oo.
80?86 only!
Grog.903
This is a dangerous non-memory resident parasitic virus. It searches for .COM-files of the current C:-drive directory and writes itself to their ends. Then this virus overwrites *.DL-files. It contains the internal strings:
TorneoDiGolf (C) '93 by GROG - Italy
*.COM *.DL
Subito dopo aver vinto il torneo di golf, egli fu intervistato alla TV.
"Questo e' il momento piu' emozionante della mia vita!", disse.
"Ti ho visto in TV", gli disse sua moglie.
"Credevo che il momento piu' emozionante della tua vita fosse stato quando ci
siamo sposati."
Al torneo successivo, egli non riusci' a qualificarsi.
Grog.990 and Grog.1200
These are benign memory resident parasitic encrypted viruses. "Grog.1200" is a polymorphic virus. The viruses hook INT 21h, and write themselves to the beginning of .COM-files that are accessed. A COMMAND.COM file is infected upon the execution of an infected file. Sometimes they change the word "Microsoft" to "Grog*Soft" in the infected program, which is loaded in the memory. This text in the files is not changed, but if the program displays the message string, "Grog*Soft" will be displayed instead of "Microsoft". The viruses contain the internal text strings:
"Grog.990":
-=_GROG4EVER!_=-
_/\[o]-[o]/\_
>>1/93<<
GROG v3.0 (C) '93 by GROG - Italy
Microsoft C:\COMMAND.COM
"Grog.1200":
-=_GROG4EVER!_=-
_/\<+>,<+>/\_
>>2/93<<
GROG v3.1 (C) '93 by GROG - Italy
Microsoft C:\COMMAND.COM
Grog.1007
This is a benign memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of EXE-files that are executed. On the 31st of every month, it displays the following message:
IlCuocoT(C)T'93TbyTGROG
It also contains the internal text strings:
+---
| Il cuoco, vedendosi scoperto, impallidi'.
| "Siete in arrosto", intimo' il poliziotto. "Ho un mandato di cottura!"
+-------
MSAVF-PRCPAVSCANCLEA
IlCuoco (C) '93 by GROG - Italy
| |T--?TGROGT4TEVERT?--T| |
Grog.1146
This is a benign memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of COM- and EXE-files upon their execution. Sometimes it launches a video effect in the same way that the "Diamond" virus does. "Grog.1349" contains the internal text strings:
grog!!!
Helen Dolcestoria
Helen (C) '93 by GROG - Italy
>>4/93<<
I sei conigliettiall
_/\{{+,+}/\_
Grog.926,1349
These are harmless non-memory resident parasitic polymorphic viruses. They search and write themselves to the end of .COM-files. They also hit the C:\COMMAND.COM file. They contain the internal text strings:
"Grog.926":
Mi Ami (C) '93 by GROG - Italy
"Mi ami?" chiese lei.
"Ma certo", rispose lui.
"Mi ami davvero?" chiese lei.
"Ma certo", rispose lui.
"Mi ami davvero davvero?" chiese lei.
"No", rispose lui.
"Mi ami?" chiese lei.
"Ma certo", rispose lui.
Lei non chiese piu' altro.
"Grog.1349":
-=_GROG4EVER!_=-
>>11/92<<
_/\(?_?)/\_
GROG v1.0 (C) '92 by GROG - Italy
C:\COMMAND.COM *.COM .. *.*
Grog.1603
This is a benign non-memory resident companion virus. Upon execution, it searches for .COM-files, renames them to a .EXE extension, and then it overwrites the original .COM-files. If all files are infected, the virus executes a .EXE-file containing the original body of the infected COM.
This virus uses program tricks by tracing its own code upon execution, and checks the opcode which will be executed and sometimes calls a special routine instead of executing of that opcode. This virus displays the following messages:
+---------------------------------------------+
? <^> JoeMetafora (C) ‘93 by GROG - Italy <^> ?
+———————————————+
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Il velario della notte avviluppava gli amanti fuggitivi.
Ad onta delle minacce di gravi cimenti, oceani di affetto li avevano tenuti
[uniti.
Ora, un nuovo ghiacciolo di terrore squarciava il ricamo della loro esistenza.
JOE METAFORA
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Grog.1635
This is a benign non-memory resident parasitic encrypted virus. It searches for EXE-files of the current directory, and writes itself to their ends. Upon infection, the file length grows by a random value. On May 5th, the virus displays:
-=_ NAPOLEONE (C) '93 by GROG - Italy _=-
Napoleone era pronto a partire per Mosca.
Bacio' sua moglie e le disse addio in un sussurro.
Mentre lui si avviava alla guerra, lei grido':
"Tienti sempre in disparte, Bonaparte!"
Grog.1641
This is a harmless non-memory resident parasitic virus. It searches for .EXE-files, and writes itself to their ends. It contains the internal text strings:
Dieta (C) '93 by GROG - Italy
>>4/93<<
+-----+
+------DIETA-------------------
?Avevano messo nome "Dieta" al loro alano danese.
?Un giorno, lei chiese al marito se avesse visto la sua cintura nuova.
?"Cintura?" disse lui. "Oh, scusa. Ho creduto che fosse un collare per cane.
?L'ho messa a Dieta."
?Poco tempo dopo, il loro matrimonio comincio' a guastarsi.
+------------------------------
[GROG4EVER]
Grog.2075,2825
These are harmless memory resident encrypted parasitic viruses. Upon execution, they search for COM- and EXE-files and infect them (C:\COMMAND.COM is infected as the first file). The viruses hit COM-files at their beginnings, and EXE-files are infected at their ends. Then the viruses hook INT 21h, and infect files upon accessing them. These viruses contain internal text strings, and do not infect the files with the names according these strings:
“Grog.2075″: MBIOMDOSSCANLEANPROTCPAV
“Grog.2825″: IBMBIOIBMDOSSCAN CLEAN F-PROTCPAV MSAV NAV
(IBMBIO*.*, IBMDOS*.*, SCAN*.*, CLEAN*.*, F-PROT*.*, CPAV*.*). Upon searching for the files, the viruses delete CHKLIST.CPS file. “Grog.2825″ deletes the files ANTI-VIR.DAT and NAV_._NO also. They also contain the internal texts:
“Grog.2075″:
>>4/93<<
GROG v4.0 (C) ‘93 by GROG - Italy
Grog v4.0 is here! HaHaHa!
C:\COMMAND.COM EXE *.*
“Grog.2825″:
-=_GROG v5.0 (C) ‘93 by GROG - Italy_=-
C:\COMMAND.COM C:\DOS\COMMAND.COM *.*
Grog.Crackers
These are benign non-memory resident parasitic viruses. Upn execution, they search for .COM-files of the current directory, and write themselves to their ends. Under debugger, they display different messages. These viruses contain the internal strings:
G r o g 4 E v e r
Grog.Crackers.NTA (c) 1993 by GROG
Grog.Crackers.Public_Enemy (c) 1993 by GROG
Grog.Crackers.Razor (c) 1993 by GROG
Grog.Crackers.The_Dream_Team (c) 1993 by GROG
Grog.Crackers.Wild_Cards (c) 1993 by GROG
Related Posts