3APA3A
Description 3APA3A
This is a variant of the "3APA3A" virus that hooks INT 16h instead of INT 13h, and tries to hit floppy disks upon each keystroke. It manifests itself with a sound effect.
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Ciao.a
Description Macro.Word.Ciao.a
This German specific macro virus contains three macros in infected documents and two ones in NORMAL.DOT:
Documents NORMAL.DOT
----------- -----------
DateiOffnen DateiOffnen - FileOpen
DateiSpeichernUnter DateiSpeichernUnter - FileSaveAs
AutoClose
The virus installs itself into the system when an infected document is closed. While installing the virus saves the current document the name C:DATEI.DOC and copies its two macros (DateiOffnen and DateiSpeichernUnter) to the global macros area (NORMAL.DOT).
The virus infects other documents when they are saved with new names (FileSaveAs). To infect them the virus copies its three macros from the C:DATEI.DOC file.
On file opening and saving with new name the virus displays the message:
Winword
Zu wenig Arbeitsspeicher!
Schlie#en Sie alle laufenden Anwendungen!
!! Es besteht die Gefahr von Datenverlusten !!
The virus also inserts into documents the text:
*** A new star is born ***
Macro.Word.Cleanup
Description Macro.Word.Cleanup
This is a Portuguese encrypted macro virus. It contains only one macro AutoOpen and replicates itself on opening documents.
In January in 2000 the virus erases all files on the C: drive, but cancels erasing if any of files presents on disk:
C:DOSMASTERPC.TXT
C:WINDOWSMASTERPC.TXT
C:WINDOWSSYSTEMMASTERPC.TXT
While deleting the virus displays the messages:
SEARCHING TEMPORARY FILE TYPE all
PROBABLE TEMPORARY FILE FOUND
Delete this file
DELETING FILE...
Files Deleted. Keep your Hard Drive cleaned !
|