ARCHIVER.ZIP	EXE.TSR. Infects files on fly in memory when the archiver
		(RAR, ARJ, PKZIP, HA) archives it. Thus, EXE files are infected
		in the archive as against same files at the disk.
HAVIRUS.ZIP	HA-WORM.TSR. First, it looks into archive for any COM file,
		then renames it to OVM and last, adds ifself into archive
		under the original name. When user has executed an infected
		file, virus installs itself into memory and then executes
		original file (OVM). Thus, user thinks that all goes allright.
INVERT.ZIP	Simple SYS virus. Infects DOS drivers by adding of new driver
		to the end of file and correcting of header of SYS-file.
TXTVIR.ZIP	Yeah! The world's first TXT virus! Actually, there are two
		viruses - COM.EXE.TSR and TXT.TSR. The first virus waits for
		opening of any TXT-file and then reads some bytes from the end
		of this file, decrypts it and checks up the CRC. The good CRC
		means that TXT-file is infected by the second virus. In this
		case the first virus installs the second virus into memory and
		hooks Int 21h. After that both viruses work separately from
		each other.
VLASOV.ZIP	EXE.HMA-TSR.POLYMORPH. There is no much free space into HMA,
		therefore virus has a swap file at the disk (C:\WINA20.386).
		To hook Int 21h virus patches original DOS handler placed
		into HMA too. HMA is same for all V86 machines, therefore once
		installed virus is present at the all tasks.
XMSVIRUS.ZIP	COM.XMS-TSR.RDA-CRYPT. The basic part of virus is placed
		into XMS, but there is a little loader into DOS memory. If it's
		necessary, loader places XMS part of virus into the DOS	memory,
		executes it and then frees allocated DOS memory.
SIMPLE.ZIP	PE-EXE.CRYPT. A very simple non-tsr Win32 virus. Scannes for
		files in the current directory and infects it by appending to
		the last section.
WINMULTI.ZIP	MZ-EXE.NE-EXE.PE-EXE.R0-TSR. Infects MZ-EXE files by appending
		to the end of file, NE-EXE by creating of new segment at the
		end of file and PE-EXE by appending to the last section.
		Operates under Windows95/98 only. At starting from MZ-EXE:
		creating of temporary dropper, V86->PROT16 (by using of DPMI
		calls), PROT16->PROT32R0 (by creating of callgate at the LDT).
		At starting from NE-EXE: PROT16->PROT32R0. At starting from
		PE-EXE: installing of SEH, PROT32R3->PROT32R0. When entered
		Ring0, virus installs itself into system memory and hooks IFS.
