Virus Database

KrK.800

Description KrK.800

It is a harmless memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are accessed. The virus does not manifest itself, it contains the text:
(c) KrK'96

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Mamm

Description Macro.Word97.Mamm

This stealth macro virus contains one empty module "MAMM" and eighteen procedures in module "aviro": AstMaster, Mhapus, Mcopy, Action, FileOpen, AutoOpen, ViewVbCode, AutoExec, AutoExit, ToolsMacro, FileTemplates, FormatStyle, Refresh, AutoClose, FileExit, ToolsOptions, WBT, WBF.
It infects the global macros area on opening an infected document. The virus also creates in MS Word startup folder two infected files:
MAMM.dot
MAMM.src

On each document opening the virus checks all already opened documents and infects them. It also infects documents on their closing.
Starting from 15 May 1998 the virus activates its payload procedure. It sets its call on time 45 minutes after document opening. Payload procedure only displays the message box:
To: MAMM
If you delete this, you have no heart

The virus hooks menus "ToolsMacroMacrosall" and "ToolsMacroVisual Basic Editor". On click of these menus the virus displays "Record Macro" dialog box with macro description:
'If you delete this, you have no heart'

Macro.Word97.Marker-based

Description Macro.Word97.Marker-based

This is a family of Word 97 macro-viruses. They infect the macros area (Normal template) globally upon opening an infected document. Other documents are infected upon closing. Some virus versions also infect documents upon their opening. While infecting, the viruses append their code to the existing macro-code, if there is any macro. In the case that there are no macro(s), the viruses just copy their code to the document or the template.
They were named for the text comments in their bodies, and this comment is used by the virus to locate the top of the code in an infected file. There are several variants of this text, depending on the virus version:
<- this is a marker!
<- this is another marker!
The viruses of this family run a log of infected computers: each time while infecting a new computer, the viruses add their code text comments with the date of infection and user address (as it is stored in Windows).
The viruses of this family indicate themselves in different manners. "Marker.a" in July starting from 23rd displays the messages:
Did You Wish Shankar on his Birthday ?
Thank You! I Love You. You are wonderfull.
You are Heart Less. You Will Be Punished For This
"Marker.c" and some other variants connect to a ftp site and send their log files there.
Marker.ay
When MS Word opens a document, the infection procedure checks and infects this document. It removes all macros from the document and copies viruse from the global macros area.
This virus also unloads all loaded templates and add-ins and deletes all files in the Word startup directory. It also changes the Word user's information:
UserName = "JonMMx 2000"
UserInitials = "MeMeX"
UserAddress = "JonMMx2000@yahoo.com"
Upon the first infection of a computer and also on 1st of any month, the virus creates, in the Windows system, a directory file "Jon.html" and sets this file as desktop wallpaper. The file contains the text:
a Poet For My Dear Love

Dear Iin

To the very best that happen in mylife
Long ago and in my mind, I can see your face lonely and lost in time
You were gone since yester month But the memories, never would dissapear
I think of you, I THINK OF YOU.
Yes it's true I can pretend. But the paint of blue, keep beat me till the end.
Yes it's hard to understand. Why you leaving me and all we dreaming on
Dear Iin, I close my eyes and see your face. That's all I have to do to be with you.
Dear Iin, altough I can not touch your face. I know what I can do to be with you
Long ago so faraway. But the light of blue, still living with me today.
You were gone since yester month. But the memories never would dissapear.
Speed Hari

Home