Virus Database

Kirti.2000

Description Kirti.2000

It is not a dangerous nonmemory resident encrypted parasitic virus. It searches for .COM files and writes itself to the beginning of the file. Depending on the system date the virus displays the messages:
Happy Birthday Kirti !
Y.S.

It also contains the text strings:
TEMPFILE.VIR TEMPFILEVIR

Check other viruses! Be aware! Use Antiviral Software

Macro.Excel97.Phantom

Description Macro.Excel97.Phantom

This is a stealth Excel97 macro-virus. It infects Excel97 spreadsheets (XLS-files). The virus contains two modules: ArtiLife and Replicator. The ArtiLife module contains the auto-function "auto_open". When an infected sheet is opened, the "auto_open" function takes control, infects Excel and sets the DeliverPayload function on execution at 16:00:00. While infecting Excel, the virus creates the infected ~XL.XLA in the Excel Start-up Path directory.
The virus is quite an unusual for macro-viruses: it has a parasitic-virus-like stealth mechanism - the virus removes its modules from sheets upon opening them and infects them again upon closing.
The DeliverPayload that is executed at 16:00 outputs the texts to the StatusBar:
The Phantom
Is watching you!
Beware!

Macro.Excel97.Police.a

Description Macro.Excel97.Police.a

This Excel97 macro virus is related to "Macro.Excel.Laroux". It infects Excel worksheets (XLS files). It contains one module "Police" and four subroutines in it: Auto_Open, action, Auto_Close, effect.
On opening an infected file macro auto_open is executed. It copies virus into new file FUCKPOL.XLM in StartupPath Excel and as a result infects Excel. The virus then defines macros Fuck as handler of sheet activation procedure, as a result the virus intercepts sheets opening and infects them.
The virus deletes menu items (stealth): Tools/Macro, Tools/Customizeall, View/Toolbars, View/Status Bar, Window/Unhide...
On opening any sheet on 1st, 13th, 31st of any month the virus removes current sheet and displays Balloons (see below). These Balloons are not displayed, if application variables UserName = "foxz" and OrganizationName = "NoMercyVirusTeam". It seems that the virus author protected itself by this trick. The texts inside Balloons look as follows:
XM97.Fucking Police
Six students of Universitas Trisakti, Jakarta, died from bullets fired by
security personnel during an action of concern staged by thousands of
students at the campus of Universitas Trisakti, Grogol, West Jakarta, on
Tuesday (12/5). The six students were shot while on campus by a flurry of
bullets, suspected to be fired by security troops on the Grogol fly-over.
Dozens of other students suffered serious and minor injuries.
XM97.Fucking Police
Until this report was prepared, around 200 students were still waiting in
the corridors of the Sumber Waras Hospital, guarding their fellow-students
still being treated in the Emergency Unit, as well as the remains of their
colleagues laying in state. A moving atmosphere prevailed around the
morgue, resounding with the shrieks and crying of the victims' relatives
(text by kompas online)
I hate You !!
Bwahahn.n.n, die you lamer!

Home