Virus Database

LaDiosa.2369

Description LaDiosa.2369

It is not a dangerous memory resident parasitic polymorphic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed. On May 5th, the virus displays a message and halts the computer:
Virus LA DIOSA ,dedicado a ANRUELO
virus demostración del NEP
all..
....Virus LA DIOSA por nIgrOmAntE 1998. (VALENCIA)

The virus also contains the text strings:
*** nIgrO_lives_here ***
nIgrOmAntE EngInE pOlymOrfIc (NEP)

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Horn

Description Macro.Word.Horn

This virus contains two macros: AutoOpen, LittleHorn. It writes itself to the global macros area on opening an infected document (AutoOpen). The virus infects documents on pressing the "e" key - to do that it intercepts keyboard events. The virus does not manifest itself in any way.

Macro.Word.Hot

Description Macro.Word.Hot

This is encrypted virus. It contains the macros: AutoOpen, InsertPBreak, DrawBringInFrOut, ToolsRepaginat. While infecting the system that virus renames the ToolsRepaginat macros to FileSave, and then infects the existing documents that are saved on disk (FileSave). While infecting the documents the virus renames FileSave macro back to ToolsRepaginat name.
While infecting the system the virus inserts the string "QLHot=nnnn" into the WINWORD6.INI file, where "nnnn" is the "triggering day", it is the number of current day of this century plus 14, for example:
QLHot=35110

The next days the virus selects random value from 1 till 6, and adds to the "triggering day". If the result is equal to the current day, the virus deletes the file before saving it to disk.
14 days after last modifying of the "QLHot" string the virus renews it.
The virus does no action if there is the C:DOSEGA5.CPI file.
The virus does not work under Microsoft Word 7.0. While opening the infected document the system displays the message:
Unable to load specified library

Home