Virus Database

HNY.690

Description HNY.690

It is not a dangerous nonmemory resident parasitic virus. It searches for EXE files, then writes itself to the beginning of the file. The original host file header is encrypted and saved to the file end. To return control to the host program the virus disinfects and executes it. Depending on files that are infected the virus decrypts and displays the message:
Happy New Year!

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.UnderGround

Description Macro.Word.UnderGround

This is an encrypted macro virus. It contains two macros. Their names are Macro7 and AutoClose in NORMAL.DOT. In documents their names are randomly selected: <letter><number>, <letter><number> (for example: T45, E53).
The virus infects the documents that are closed (AutoClose). To infect the global macros area (NORMAL.DOT) on opening an infected document, the virus sets one of random named macros in document as the auto-macro. As a result, the macros in infected document do not have any auto-name, but they are executed while opening this document as the AutoOpen auto-macro.
While infecting the virus creates a temporary macro. While infecting the NORMAL.DOT the virus displays the MessageBox and asks a user for permission:
SoftWare UnderGround
Can I install myself into your NORMAL.DOT
[YES] [NO]

In case of "YES" the virus infects the NORMAL.DOT, displays the statistic information about current document and document author's name.

Macro.Word.Unhas

Description Macro.Word.Unhas

This virus contains three identical macros that are named AutoOpen, JJAB, JJAO. The virus replicates itself on opening document (AutoOpen). It displays the MessageBox:
Virus MS Word by Mashoer Majid, ELektro Teknik Unhas

Home