Virus Database

Anarchy.9594

Description Anarchy.9594

This is a benign polymorphic memory resident parasitic virus. It hooks INT 9, 21h, 28h and writes itself at the end of COM (except COMMAND.COM) and EXE files that are executed or closed. The header of the infected COM files contains the text strings:
JAN FAKOVSKIJ,USSR,1994
All infected files contain the not encrypted ID-string at their ends:
UNFORGIVON
On 48th infection the virus displays one of the messages (two of them are in Russian) and halts the system:
DIS IS DI END,
BEAUTIFUL FRIENDall
DIS IS DI END,
MY ONLY FRIEND-
DI END.
IT HURTS TO SET U FREE,
BUT U'LL NEVOR FOLLOW ME.
DI END-
OF LAUGHTER & SOFT LIES,
DI END OF NIGHTS...WE TIRED TO DIE...
DIS IS DI END
I WANNA DESTROY DA PASSORS-BY
'CAUSE I
WANNA BE,-
YEAH,- ANARCHY
On pressing [Alt]-[GreyMinus] the virus calls the trigger routine that emulates the file shell a'la Norton Commander and allows to copy, move, delete the files and subdirectories and so on. That routine displays the menu like this one:
3584000

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Chaos

Description Macro.Word.Chaos

This is the encrypted virus, it contains four macros:
in NORMAL.DOT in infected documents
FileOpen TempFileOpen
FileSave TempFileSave
AutoExec TempAutoExec
TempAutoOpen AutoOpen

On FileOpen or FileSave (file opening or saving) the virus writes its code to the file. On AutoOpen the virus installs itself into the system. In case of error displays the message:
Unexpected error! Error code -

On AutoExec the virus depending on system random counter either prints to status line the string "x/500", where "x" is a random number, or prints "500/500" and halts the computer.
The virus contains commented strings:
*********************************
* -x UlTiMaTe x- *
* CCCCC H H AAAAA OOOOO SSSSS *
* C H H A A O O S *
* C HHHHH AAAAA O O SSSSS *
* C H H A A O O S *
* CCCCC H H A A OOOOO SSSSS *
* -x v2.3 - 1st June, 1996 x- *
*********************************

Macro.Word.Cheat

Description Macro.Word.Cheat

This is an extremely short and primitive macro virus. It contains only one macro AutoOpen and replicates itself on opening documents. It does not manifest itself in any way.

Home