Virus Database

Exploit.Linux.Lacksand

Description Exploit.Linux.Lacksand

This exploit is written in C, and is approximately 16KB in size.
It uses a loophole present in NIPrint LPD-LPR Print Server versions 4.10 and lower.

Check other viruses! Be aware! Use Antiviral Software

Macro.Office.Halfcros.a

Description Macro.Office.Halfcros.a

This is multi-platform macro-virus. It infects two MS Office97 applications: Word documents and Excel sheets. The main part of the virus code is encrypted and placed in the virus body as a random-letters comments. In case of need, the virus gets these comments, decrypts them, convert to the macro instructions and executes them. As a result, the main replication routines are invisible by viewing macro code in the Tools/Macro menu.
In non-encrypted form, there are just a few virus macros present: events hookers and decryption routine. The virus hooks three events: Excel sheets closing, and Word documents opening and closing (Workbook_Deactivate, Document_Open, Document_Close). In all these cases, the virus decrypts and calls the infection routine. The virus also creates the infected BOOK1 Excel sheet in the Excel auto-start directory.
The virus disables the MS Office virus protection by directly accessing the system registry. Starting from 0:10pm till 0:25pm, the virus displays the message box:
Wonder v2.0 by ThE wEiRd GeNiUs
Its time for lunch

where is the name of current user.

Macro.Office.Hopper

Description Macro.Office.Hopper

These are multi-platform macro-viruses infecting Office97 components: Word documents and Excel sheets. The viruses contain two auto-macros in Excel sheets and Word documents: Document_Close and Workbook_Deactivate.
The viruses replicate themselves in Excel upon deactivating workbooks. In Word, the viruses replicate upon document closing. The minor virus version spreads only from Excel to Word and not back, and the major virus version migrates from Word to Excel and back with no problems.
The viruses turn off the VirusProtection MS Office option. Depending on the version, the viruses contain the the following text comments or display them in MessageBox:
Ex-cell v0.1 /1nternal
Cross.BadSeed v0.1 /1nternal
Cross.BadSeed v0.2 /1nternal
Cross.BadSeed v0.3 /1nternal
Cross.BadSeed v0.4 /1nternal

Home