HH.1024.b
Description HH.1024.b
This is a very dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed or opened. On 11th of every month it erases the hard disk sectors. It contains the text string "HH" that is used as ID-word to identify already infected files.
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Candyman.a
Description Macro.Word.Candyman.a
The macro viruses of this family contain three macros:
"Candyman.a": Autoopen, Candyman, AutoClose
"Candyman.b": Autoopen, Dyatrima, AutoClose
They infects the global macros area on opening an infected document (AutoOpen), and infect other documents on their closing (AutoClose).
On 25th of any month the "Candyman.a" virus deletes all files in folders C:WINDOWS and C:DOS. Then it displays the message:
No se olviden de CABEZAS -Pierri y Duahlde
PUTOS-Cabezas Virus by CANDYMAN Bs. As. Argentina
The "Candyman.b" virus drops and executes the DYA.COM file infected by the DOS overwriting virus "HLLO.Candym".
Macro.Word.Cap
Description Macro.Word.Cap
CAP - infection routine AutoExec - calls the infection routine AutoOpen - - // - FileOpen - - // - FileSave - - // - AutoClose - - // - FileClose - - // - FileSaveAs - - // - ToolsMacro - hides all macros ("stealth" routine) FileTemplates - - // -
The virus not only disables ToolsMacro and FileTemplates menus, but also deletes the references to them in the File and Tools main menus. The virus also disables auto-macros. As a result it is not possible to disinfect this virus by using Word functions -it is not possible to delete macro viruses by creating new or running existing virus removing macros.
The virus emulates "FileSaveAs" while saving infected documents -and writes an empty document to disk.
The virus contains the following strings (comments):
C.A.P: Un virus social.. y ahora digital..
"j4cKy Qw3rTy" (jqw3rty@hotmail.com).
Venezuela, Maracay, Dic 1996.
P.D. Que haces gochito ? Nunca seras Simon Bolivar.. Bolsa !
|