FFFF.432
Description FFFF.432
This is a dangerous memory resident parasitic virus. It copies itself into the Interrupt Vectors Table, hooks INT 21h and writes itself to the end of COM files that are executed. It contains the hexadecimal word FFFFh at its beginning.
Depending on the system date the virus erases C: drive's disk sectors.
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.NiceDay
Description Macro.Word.NiceDay
This virus is based on Word.Macro.Concept virus. It contains four macros:
in NORMAL.DOT in infected files
PayLoad Payload
AutoExit AutoExit
VOpen AutoOpen
AutoClose VClose
Payload macro contains the same text as "Word.Macro.Concept":
That's enough to prove my point
On AutoExit the virus displays the message:
Have a Nice Day !
Macro.Word.Niki
Description Macro.Word.Niki
This encrypted virus contains six macros: AutoExec, AutoOpen, FileApri, FileSalvaConNome, StrumMacro, NiKI. The virus infects the global area on AutoOpen and writes itself to the documents on FileApri (FileOpen?) and on FileSalvaConNome (FileSaveAs?).
The virus in some way modifies the Tools/Customize menu. Depending on the system time it runs its trigger routine (macro NiKi) that in some way modifies the current document and deletes *.DOC and *.DLL files in C:MSOFFICE and C:WINDOWSSYSTEM directories.
|