Virus Database

Areg Family

Description Areg Family

These are not dangerous not memory resident parasitic viruses. They search for COM-files of the current directory and write themselves at their ends. Then they type with the probability 1/8 a text message in Russian. They also contain the internal text string : "(C) 1993 AREG Soft".

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Imposter

Description Macro.Word.Imposter

This is a plagiarism from "Word.Macro.Concept" and "Word.Macro.DMV". It contains two macros:
in infected document: AutoClose, DMV
in infected NORMAL.DOT: FileSaveAs, DMV

While infecting the system the virus receives the control in AutoClose document, renames DMV macro to FileSaveAs, then renames AutoClose to DMV. While infecting the files (FileSaveAs) the virus renames these macros back DMV -> AutoClose, FileSaveAs -> DMV.
While infecting the documents the virus displays the MessageBox:
DMV

One of the strings in the virus body looks like follows:
just to prove another point

Macro.Word.Incarnate

Description Macro.Word.Incarnate

This is the Word macro virus. It contains seven macros: AutoExec, AutoExit, FileSave, AutoClose, FileClose, FileSaveAs, ToolsMacro.
The virus infects the global macros area (NORMAL.DOT) on closing an infected document (AutoClose, FileClose) and writes itself to documents that are saved (FileSave) or saved with new name (FileSaveAs). The virus contains a bug and while infecting by FileClose copies the same macros FileSaveAs to new macros FileSave and FileSaveAs. As a result the virus discloses itself on saving a document - instead of saving Word displays the FileSaveAs dialog box.
While closing a document the virus also appends the its end the text:
To end with, I would like to sayall
To defy me is to bring upon my wrath...
For I am CyberDarkness
I am Darkness Incarnate...
I will Not be Denied!!!
<year> CyberDarkness

On leaving Word the virus writes new Desktop color set to the WIN.INI file.

Home