Virus Database

Fasola.2215

Description Fasola.2215

It is not a dangerous nonmemory resident parasitic virus. It searches for EXE-files, then writes itself to the end of the file. The virus looks for the string "JAREK=OFF" in Environment area, and performs no action if that string is found. Depending on the system date and time the virus displays the photo of some man (virus author?), and displays the message:
Jarek Szczukowski wita !!!

The virus also contains the text strings:
*.* *.exe
Virus (C) Ja? Fasola'95 all rights reserved
Tylko MKS-VIR to porz?dny program antywirusowy
Nie daj si? naci?gn?c na jakie? Norton Antivirus albo inne badziewie w
'adnej graficznej oprawie
Pamietajall MKS-VIR

? = characters not supported in this character set.

Check other viruses! Be aware! Use Antiviral Software

Macro.Excel.Extras.a

Description Macro.Excel.Extras.a

This virus infects Excel sheets. It contains fiveteen functions in one random named module: Auto_help, Auto_Open, Auto_Close, Auto_Exit and others with random names.
While infecting sheets the virus copies its module with a randomly selected name. While infecting Excel the virus creates an infected sheet in the Excel startup directory. The name of this sheet depends on the installed system:
System File name
------ ---------
Windows 3.xx EXTRAS.XLS
Macintosh Macintosh Extras
Windows 95/NT/all Windows Extras.xls

Depending on the system random counter the virus creates directories with random selected names. Starting from 1999 the virus hides the selected Excel menus randomly.

Macro.Excel.Hidemod

Description Macro.Excel.Hidemod

This virus infects Excel sheets. It contains six macros: Auto_open, Auto_close, ChangeCell, CreatePers, CheckV101, HideModV101 and several functions in one module "ModulV101".
To infect the system the virus creates the infected PERSONAL.XLS file in the ALTSTART directory and declares it as the Alternate Startup directory. To create this file the virus looks for Windows directory and creates it there:
C:WINDOWSALTSTART
C:WIN95ALTSTART
D:WINDOWSALTSTART
D:WIN95ALTSTART

If there is no such directories, the virus creates alternate directory on the C: drive: C:ALTSTART.
To infect other sheets the virus hooks sheets activation procedure. The virus handler also has stealth ability: it does not allow to examine a module with the virus, switching current page to first non-virus found.
The virus also hooks formulas calculation procedure and with probability 30% erases the source formula and replaces it with calculated result (i.e. this cell will be not recalculated).

Home