Virus Database

Freddy.2271

Description Freddy.2271

It's a polymorphic virus, it searches for the COM- and EXE-files and hits them on every INT 21h call. Sometimes on saving the data to the file (INT 21h, ah=40h) this infector saves a random byte. It contains the internal text strings:
COMMAND.COM *.COM *.EXE
Freddy KRueGer 2.1
Fridrik!

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Why

Description Macro.Word.Why

This virus contains only one macro, but while infecting copies it to two macros in documents and to three macros in NORMAL.DOT:
documents: AutoOpen, makemacros
NORMAL.DOT: AutoOpen, AutoClose, makemacros

The virus infects the global macros area (NORMAL.DOT) on opening an infected file (AutoOpen), and infects documents that are opened or closed (AutoOpen, AutoClose).
The virus displays the DialogBox:
Why Why Why
Why doesn't pepole work?
No money
No drink
No eat
No instant noodles
No lunch box

Macro.Word.Williamto

Description Macro.Word.Williamto

This is an encrypted Word macro virus. It contains 16 macros: Halim, FileNew, AutoOpen, FileOpen, FileSave, FileClose, FilePrint, HelpAbout, Williamto, FileSaveAs, ToolsMacro, FormatStyle, JustifyPara, ViewToolBars, FileTemplates, ToolsCustomize.
The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are opened, saved or saved with new name (FileOpen, FileSave, FileSaveAs).
This is the stealth virus: it draws its own dialog on entering Tools/Macro menu, on pressing any button the virus displays the MessageBox:
WordBasic Err = 7
Not enough memory

After opening a file the virus displays the message:
Williamto Virus
Williamto WordBasic Virus
Programmed by Williamto Halim
Virus Research Laboratory
Dedicated to Angelia Hadeli

On error while saving files the virus displays:
Attention!!!
Williamto Halim always lives in your computer

On closing files it displays:
File Close
Please close it later! Let's have fun!

On July 9 it displays:
Nice Day
Happy Birthday Amgelia Hadeli by Williamto Halim

The virus also replaces the "About Microsoft Word" with:
About Microsoft Word
Williamto WordBasic Virus
Programmed by Williamto Halim
Virus Research Laboratory
Dedicated to Angelia Hadeli

On printing documents the virus erases original text and prints its text:
Welcome to Williamto Word Macro Virus
I'm sorry about this but your computer has been infected by
Williamto Word Macro Virus
Please beware about this!!!
This Virus will destroy your data in your disk!!!
Copyright 1997 Virus Research Labs (Jakarta/Indonesia)

While printing the virus outputs to the status line the text:
[ Welcome to Williamto Word Macro Virus - Programmed & Written by
Williamto Halim the Hackers - Virus Research Laboratory ]

On November 11th the virus formats the hard drive and displays the MessageBox:
Attention!!!
I will format your hard disk now, ha-ha-ha!

Home