Virus Database

Konrad.999

Description Konrad.999

This is a dangerous, non-memory resident encrypted parasitic virus. It searches for .COM files, then writes itself to the end of the file. On November 9th, the virus hooks INT 13h, and sounds upon accessing to the hard drive. The virus does not leave an INT 13h handler as a memory resident program, and after host-program termination, the computer halts.
The virus contains the following texts:
ZuSe by DiGiTAL
by DiGiTAL [TECHNO]logies
+-------------------------+
|Name: KoNrAd ZuSe 1.0 |
|ORiGiN: Ost-Berlin (FRG) |
|Creator: -= DiGiTAL =- |
|Size: 999 bytes/501 bytes|
|last UpDate: 04-28-93 |
+-------------------------+
| not resident |
| infects COM-files only |
| uses SeLf-EnCrYpTiOn |
| RuN-TiMe oPeRaTiOon |
+-------------------------+
Grz2: ThE GuYz FrOm ThE FeZ, !TWIN, SyNeC, RoY, WaNgLeR 'n'
all -= (*) TELEKOMiKER (*) =- (kotz,brech,ätz,krepel,übergiball

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Oetzi

Description Macro.Word97.Oetzi

It is a polymorphic virus. It contains eight macros in module "Modul1": AutoOpen, AutoClose, FileSaveAs, FileSave, ToolsCustomize, Mutate, Retro, Payload. It replicates on activation any of macros: AutoOpen, AutoClose, FileSaveAs, FileSave. The virus polymorphic engine inserts comments at random positions in the virus code.
The virus displays the Balloon:
Wichtig! Lesen sie folgendes genau durch:
He Bedienung! 5 Bier! Auch einen für diesen Schnapsgsicht daall. Danke!

The virus then displays the MessageBox:
W97M.Oetzi.A
Hallo, mein name ist Ötzi. Ihr könnt mich mal besuchen kommen. Für 8-9
Cuba Libre laß ich euch vielleicht gratis rein. UEO!!!
NEGSTE BUDE = 500m !!!!!!

It also erases the anti-virus files:
C:PC-Cillin 95Scan32.dll
c:pc-cil~1*.dll
C:PC-Cillin 95Lpt$vpn.*
C:PC-Cillin 97Scan32.dll
C:PC-Cillin 97Lpt$vpn.*
C:TscPC-Cillin 97Scan32.dll
c: scpc-cil~1*.dll
C:TscPC-Cillin 97Lpt$vpn.*
C:TBAVW95Tbscan.sig
c:Tbavw95Tb*.*
C:Tbavw95Tbavw95.vxd

Macro.Word97.Onex

Description Macro.Word97.Onex

The macro virus Word97.Onex contains only one macro named Extra. This macro contains an auto-function Document_Open that allows the virus to infect the system and documents upon opening the file and activating the virus.
The virus contains the following copyright string:
"Word 97/2k.Extra - Psyclone X"
"My first virus for the year 2k"

Home