Virus Database

Junkie.1308

Description Junkie.1308

This is a memory resident multipartite encrypted very dangerous virus. It hooks INT 13h, 1Ch, 21h and writes itself to the end of COM files that are executed or opened, and floppy boot sectors while reading from floppy and MBR of hard drive while executing of infected file.
Depending on the system date it formats the disk sectors, and displays the message:
Disk Death
The virus contains the internal text strings:
Bad Junky
I want a job

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Greenpeace

Description Macro.Word.Greenpeace

It is an encrypted Word macro virus, it contains seven macros:
Documents NORMAL.DOT
FlSvvs FileSaveAs
FlSvv FileSave
AtExc AutoExec
FlOpvvv FileOpen
AutoOpen ImpRovevvvv5
TlsMcr ToolsMacro
FileExit FClccc

The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are saved with new name (FileSaveAs).
On 22 May 1998 when Word is starting, the virus displays the MessageBox:
Belik Natasha demands:
Stop pollution of an environment!!!!!
Protect ozonian layer!!!
Rescue Volga!!!
Pay the salary!!!!!
GreenPeace Virus

If the author of document is "Igor Daniloff", the virus replaces the AutoOpen and IDRWEBSCAN macros with harmless ones: new AutoOpen displays the MessageBox:
In the WinWord6.0/7.0rus environment
the viruses are not distributed
DrWeb for WinWord

IDRWEBSCAN is replaced with do-nothing macro.
On entering the "Tools/Macro" menu the virus sets the document password protection (password="orhey"), and resets it after leaving "Tools/Macro".

Macro.Word.Grunt

Description Macro.Word.Grunt

This is an encrypted virus. It contains two macros: XxGRUNTxX1 and XxGRUNTxX2. Because this virus has no auto-macros, it takes control by assigning the 'E' key to "XxGRUNT1xX1" macro, and the 'I' key to "XxGRUNTxX2" macro, i.e. when 'E' or 'I' keys are pressed, corresponding macro takes control. MS Word saves these redirections in documents, and these keys are automatically assigned with macros when Word is opening an infected document or global macros.
The virus does not manifest itself. It contains the string:
A Virus from Nightmare Joker's Demolition Kit!

Home