Am.743
Description Am.743
This is a harmless memory-resident parasitic virus. It hooks INT 21h and writes itself at the end of COM files that are executed. It contains the text "am", the same value is returned (in ASCII) by the virus when it checks the previously loaded TSR copy.
On calling the GetDate DOS function the virus decreases the year value.
The virus hooks INT 08h also and displays the message:
Hello from TURKIYE. I am TURCO Virus.
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Ultras.Goblin2
Description Macro.Word.Ultras.Goblin2
This virus infects the Word documents. The infection is run on documents opening or closing.
On Tuesday it creates the Zoo.383.b virus dropper on the C: drive, inserts into the C:AUTOEXEC.BAT file the command to execute it and displays the MessageBox:
ULTRASall
GoBLiN II by ULTRAS
Thank you Dirty Nazi [Stealth group WorldWide]
for such beautiful virus.
Macro.Word.Ultras.Joke
Description Macro.Word.Ultras.Joke
These viruses infect the Word documents. The infection is run on documents opening or closing.
The virus sets to "Ultras/Joke/ULTRAS2.usa.net" the Name/Initials/Address in document's UserInfo fields. The virus also makes changes in the Registry:
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion]
"RegisteredOwner"="ULTRAS"
"RegisteredOrganization"="Rioters"
"ProductName"="JoKe By ULTRaS"
[HKEY_CLASSES_ROOTWORD.DOCUMENT.6DefaultIcon]
C:WindowsSystemShell32.dll,31
[HKEY_CLASSES_ROOTWord.TemplateDefaultIcon]
C:WindowsSystemShell32.dll,32
|