Ghost
Description Ghost
It is a dangerous memory resident boot virus. It infects the MBR of the hard drive and boot sector on floppy disks. While infecting the virus saves the original MBR sector on the hard drive at the address 0/0/8 (track/head/sector) and the original boot sector of floppy disks to the last sector of root directory.
On loading from infected disk the virus copies itself into Interrupt Vectors Table and hooks INT 13h. It then infects floppy disks that are accessed. The hard drive MBR gets infection while loading from infected floppy disk.
While loading from infected floppy disk, if the MBR is already infected, the virus disinfects it: restores the original MBR image and fills sector 0/0/8 with zero byte. While disinfecting the virus leaves its "signature" in the last entry in Disk Partition Table: "GHOST".
The virus uses quite risky anti-debugging trick and as a result halts Pentium computers.
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Akay
Description Macro.Word.Akay
This is an encrypted macro virus. The virus replicate on opening files (AutoOpen). It contains four original macros, that are copied to six macros during infections:
Documents NORMAL.DOT
Macro1 AutoExec AutoExec
AsliAutoExec AsliAutoExec
Macro2 FileOpenx FileOpen
Macro3 AutoOpen FileOpenx
AutoOpenx
Macro4 AntiMacrosVirus AntiMacrosVirus
While installing the virus searches for 42 macros of other viruses and deletes them. On each start the virus displays the MessageBox:
Created By Akay Inc.
Microsoft Anti-Virus Protection version 1.0
Macro.Word.Alex.a
Description Macro.Word.Alex.a
This is an encrypted Chinese Word macro virus. It contains from three to five macros depending on the virus version: autonew, autoopen, autoclose, toolsmacro. It also contains empty macro:
ALEX
The virus replicates itself when documents are created (autonew), opened (autoopen) or closed (autoopen). Depending on the current day it erases the files on the C: disk.
|