Virus Database

HLLP.Nover.7712

Description HLLP.Nover.7712

This is a harmless non-resident virus, 7712 bytes in size, written in Turbo Pascal.
It searches the C: and D: disks for .EXE and .COM files. It also searches directories listed in %path% for these files, and writes itself to the beginning of the files found. Files infected by the virus will contain the text strings
omret
Aria

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Tele-Sex

Description Macro.Word.Tele-Sex

It is an encrypted virus. It contains seven macros:
AutoExec - infects the global macros area
AutoOpen - calls AutoExec (infects global)
DateiNeu - infects a document (FileNew)
Telefonica - virus ID macro and trigger routine,
is called from AutoExec and Dateioeffnen
Dateioeffnen - infects a document (FileSave)
DateiBeenden - infects a document (FileExit)
DateiDrucken - trigger routine.

When Telefonica macro is executed, it launches DOS "Telefonica" virus. To do that the virus creates the script file C:DOSTELEFONI.SCR with hexadecimal dump of virus. Next it creates C:DOSTELEFONI.BAT, writes following commands to there, changes current directory to C:DOS and executes BAT file:
@echo off
debug < telefoni.scr > nul
@echo off
telefoni.com

These commands convert hex dump to DOS executable file and run it.
On DateiDrucken (FilePrint), if current seconds < 10, the virus adds to the end of document the string:
Lucifer by Nightmare Joker (1996)

Macro.Word.Temple

Description Macro.Word.Temple

This macro virus contains four macros that have different names in documents and NORMAL.DOT:
Documents NORMAL.DOT
TempAutoExec AutoExec
TempFileSave FileSave
TempFileOpen FileOpen
AutoOpen TempAutoOpen

While loading an infected document (AutoOpen) the virus infects the global macros area (NORMAL.DOT). On saving or opening a file (FileSave, FileOpen) the virus infects the current document.
The virus does not manifest itself in any way.

Home