These are memory resident, encrypted EXE infectors. They all have exactly the same function, and they differ only in text that is occasionally displayed on the screen. The viruses attack files as they are executed, opened for writing or reading. When an infected program is executed the system date is tested. Service of the interrupt INT 1C, which, depending on the internal variable, causes graphic effect, is installed on the 13th day of a month. Furthermore, all these viruses check whether the sequence number of the day within the month is equal to the sequence number of the month within the year. In case of coincidence, except for December, text is written on the screen. The viruses write it on red background, only Raptor.D on a blue one. The text is encoded in the infected file as well as in memory. After displaying the text the virus waits until any key is pressed and finally resets the computer. The following texts are displayed on the screen:

Raptor.A, Raptor.B, Raptor.C:

The Raptor virus version 1.5 Copyright 3.12.1993 - Hacker club Brno - Czech republic Don`t panic!! This virus doesn`t destroy data! I am most kindly virus! I should inform you that soon comes Raptor2.0 with special sealth systems! You can be sure that Raptor2 will be totally untouchable!

The information on virus version may be altered to 1.7 and 1.4, respectively.

Raptor.D:

The Rotpar virus 1st version Copyright 13.3.1994 - PHP students Blansko CR Did you like the red color in the background ? We didn't like it !! We changed it into blue. The texts were also stupid, so we changed them too !! Many happy returns in the next version of Rotpar. Thanks !

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.