Virus Database

Email-Worm.Win32.Monikey.a

Description Email-Worm.Win32.Monikey.a
This worm sends itself as an infected message to email addresses harvested from the victim machine. Infected messages contain a link to a server where a copy of the worm has been placed. The worm can also spread via file-sharing networks. The worm itself is a PE EXE file approximately 80KB in sizeall

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Nomvir

Description Macro.Word.Nomvir

This is a very dangerous virus. It contains ten macros: AutoExec, AutoNew, AutoOpen, DateiSpeichern, DateiSpeichernUnter, DateiBeenden, ExtrasOptionen, DateiDokvorlagen, FuckIt, and DateiDrucken.
Upon AutoNew and AutoExec, it infects the global macros area. Upon DateiSpeichern and DateiSpeichernUnter (FileSave, FileSaveAs), it infects a document.
The virus looks for the "Nomvir=" parameter in the "Compatibility" section (WIN.INI file), and does not perform any action if there is "Nomvir=0x0690690". The virus also creates a counter "iCount" in the "intl" section, and increases it when any document is printed. Depending on the counter, the virus deletes the C:AUTOEXEC.BAT and C:CONFIG.SYS files. Depending on the system date, the virus replaces some words in documents with "hell" or appends to the end of the document the following text:
Fuck Microsoft & Bill Gates

On January 1st, December 25th, on the 23rd of any month, and on Saturday 13th, it deletes the following files:
C:WINDOWSUSER.DA0
C:WINDOWSSYSTEM.DA0
C:WINDOWSUSER.DAT
C:WINDOWSSYSTEM.DAT

Depending on the system time, the virus sets randomly selected passwords for documents. Upon accessing Tools/Macro and the DateiDokvorlagen menu, the virus displays the MessageBoxes:
Nicht genügend Arbeitsspeicher !
Interner Fehler !

Macro.Word.NOP

Description Macro.Word.NOP

These are silly macro viruses containing two macros. While infecting the system global area (on AutoOpen) or a document (on DateiSpeichern - FileSave) the viruses copy their macros with other names:
NORMAL.DOT Infected files
Macro1 DateiSpeichern NOP
Macro2 NOP AutoOpen

"Nop.d" has other set of names: AutoOpen and FileSave.
The viruses are very short - summary length of their macros is:
"Nop.a" - 246 bytes
"Nop.b" - 250 bytes

"Nop.a" has no destruction or trigger routines. "Nop.b" on FileSaveAs inserts the text "Testvirus" into current document. "Nop.e" searches for the text ". SAP" in the current document and replaces it with ". SÅP".

Home