Lucy family
Description Lucy family
These are dangerous memory resident parasitic polymorphic viruses. They hook INT 21h and write themselves to the end of COM and EXE files that are accessed, except several anti-viruses and utilities (see the list below). While installing memory resident the viruses also scans the system memory for several anti-virus monitors and disable them.
The viruses have bugs and in some cases halts the computer. Under debugger "Lucy.5286" displays the message:
Hi, do you know that AndreaP is actually better than LucyV ?
Takze ak sa vam chce, tak to meno zmente. :-).
PS. Pochadzam[e] (ja i ona) z GJH. (mozno)
Press any key to reset.
The viruses also contain the texts:
* EMM386 *
COM EXE
TBMEMXXXTBCHKXXXTBDSKXXXTBFILXXXCOMMAND
"Lucy.5086":
COM EXE SCAN VSHIELD CLEAN FINDVIRU GUARD VIVERIFY
TB -V VIRSTOP NOD HIEW ICE AVG F-PROT CHKDSK DRWEB
"Lucy.5286":
SCAN VSHIELD CLEAN FINDVIRU GUARD VIVERIFY TB AVP
VIRSTOP NOD HIEW ICE AVG F-PROT CHKDSK DRWEB TD
scanning
Check other viruses! Be aware! Use Antiviral Software
Macro.Word97.Bptk
Description Macro.Word97.Bptk
This is a rather humerous Word macro-virus. The virus macro Document_Open only infects the system macros area and current document upon opening. The virus manifests itself with the Russian text "ÁÏÒÊ".
Macro.Word97.Break.a
Description Macro.Word97.Break.a
This virus infects the Word97 documents as well as overwrites VBS script files Windows. The body of virus code has two blocks. The first block contains script-program that gets control in script instance of virus, the second parts contains Word macros.
The virus replicates under Word on documents closing. On 15th of any month the virus searches and overwrites all script .VBS files on the C: drive. When any of affected script files is executed, the virus copies its code to Word global macros area (NORMAL.DOT).
|