Virus Database

Hacker.255

Description Hacker.255

It is a very dangerous memory resident overwriting virus. It hooks INT 21h and overwrites each 5th file that is executed. The infected files are not recoverable and should be deleted. The virus contains the text string:
MEGA TROJAN VIRUS 1992 BY HACKER!!all

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Mensagem

Description Macro.Word.Mensagem

This is a silly macro virus. It contains only one macro AutoOpen and infects the system and document on documents opening. Before infecting the virus displays running message:
Scion Graphic - (Brazil-1997)

The virus contains comments:
Mensagem exibida pelo vírus
Salva o arquivo como modelo
Espalha o vírus copiando a macro AutoOpen para outros arquivos

Macro.Word.Mentes

Description Macro.Word.Mentes

This is an encrypted Word macro virus. It contains ten macros: Killer, AutoExec, AutoOpen, DocClose, FileOpen, FileSave, AutoClose, FileSaveAs, ListMacros, ToolsMacro.
The virus replicated on opening an infected document, saving and saves with new name. The replication routine presents only in one macro Killer, other macros call it to spread the virus. The infection subroutine in the virus is named "MENTES".
The virus author leaves a possibility of self-destruction: if the MY.INI file exists in Windows directory, and it contains the section [Word Info] with the "Kod=aaa" string inside, the virus disables its infection routine and removes all its macros.
The virus is able to "steal" documents when they are saved. To do that the virus writes the C:LOGIN.SYS file name of closed document, current date, time and contents of the document. It then connects the \HS_WORKHCOMMONSTUDENTTEMP disk and moves to it the C:LOGIN.SYS file to the first logical drive that is write-enabled. The name of new file is ARCHIVE.A??, where '??' is number from "10" till "50". This file name is also saved to the PROG.INI file on the same disk.
On entering the List/Macros and Tools/Macro Word menus the virus displays the MessageBox and cancels execution of original macros viewing routines (stealth):
Macro function is not installed.

Home