Ka.863
Description Ka.863
It is a harmless memory resident parasitic partly encrypted virus. It hooks INT 21h and writes itself to the end of .EXE files that are executed. It contains the text string:
KA
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Gable
Description Macro.Word.Gable
This is a harmless Word macro virus. It contains two macros: AutoOpen, FileSaveAs. It infects the global macros area on AutoOpen and writes itself to documents on FileSaveAs. It does not manifest itself in any way.
Macro.Word.Gang
Description Macro.Word.Gang
This is an encrypted virus. It contains two macros: Paradise, Gangsterz. The virus does not have any auto-macros and to receive control it assigns SPACE key to macro "Paradise" and "E" key to macro "Gangsterz". As a result MS Word will call these macros on SPACE and "E" key. MS Word will also restore these keys assignments any time when loading an infected document or global macros.
On January 15th the virus calls its trigger routine - it creates the NORMAL.DOT file and insert the text written in Bold FontSize 26 to there:
Big_Daddy_Cool Virus generated by NJ
and then draw some picture in there.
The virus drops the batch virus "BAT.Xop", writes to system profile (WIN.INI file) the strings:
[Intl]
XOP=Installed
and appends to the end of C:AUTOEXEC.BAT file the commands:
@echo off
Xop.bat
|