Virus Database

M5VP2.1678

Description M5VP2.1678

M5VP2.1678 is a not dangerous not memory resident encrypted parasitic virus. It searches for COM-files and writes itself at their ends. Depending on system time it displays the message:
+-----------------------------------------------------------+
¦ Program, który wlasnie uruchomiles jest zarazony wirusem ¦
¦ M5-VP2. Wirus ten jest lagodny i niczego nie uszkadza. ¦
¦-----------------------------------------------------------¦
¦ Jezeli jestes zainteresowany nabyciem wersji zródlowych, ¦
¦ wyczerpujaco skomentowanych, nastepujacych wirusów: ¦
¦ Enrico-Pro (Companion Virus), M2, M2b, M3, M4, M4b, ¦
¦ 1-May (Socialism-II), 4DOS-Friend, v286, to zadzwon do 31 ¦
¦ maja: Zielona Góra, telefon grzecznosciowy: 72-785, TYLKO ¦
¦ W PONIEDZIALKI (robocze) od 18.30 do 19.30. ¦
¦ Cena dyskietki: 120.000 zl. ¦
+-----------------------------------------------------------¦
¦ Po 01.06.1993 podany powyzej telefon jest nieaktualny. ¦
+-----------------------------------------------------------+
Press any key to continueall

It also contains the internal text string:
M5-VP2 Virus

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Titasic

Description Macro.Word97.Titasic

This is a quite complex macro-virus consisting of about 400 lines of code, and it contains about twenty macros and functions in one module "astia". It replicates upon document opening. It also creates the infected templates SNRML.SRC and SNRML.DOT in the Word startup directory.
The virus under different conditions displays several messages and manifests itself in several ways. For instance, upon the opening of the macro-diting Word menus, the virus displays MessageBox with Yes/No buttons:
Titasic
Maaf..
Anda jangan coba-coba mengedit, merubah, ataupun menghapus makro Titasic..!!
Anda hanya bisa merekam makro, menyimpan, menggunakan
serta menghapus makro buatan Anda
Apakah Anda ingin merekam makro..?

On "Yes", the virus inserts the string "'Macro non-Titasic'" into the current document.
Within 45 minutes following activation, it also manifests itself with a video effect.
Titasic.b (a.k.a. W97M.Astia.y and W97M.BMH)
This virus is very similar to the original one. The virus module has the "BmH" name, and upon opening the macro-editing Word menus, the virus displays a MessageBox with Yes/No buttons:
MacroBasic
Are you sure want to create a new macro?

On "Yes", the virus inserts the string "'MacroWordBasic'" into the current document.
In 15 minutes after activation, it also manifests itself with a video effect.
Titasic.e
Upon opening an infected document, this virus infects the global macros area (Normal template). Then it activates a timer that summons the main infection routine every seven minutes. This routine in an opened document deletes all macros, and then copies the virus macros from the global macros area.
The virus blocks Visual Basic Editor from opening by requesting a password, which is "azizoke".
Upon exiting Word, the virus checks the system time. If it is Friday or Sunday and earlier than 9:00 p.m., the virus displays following message:
Ucapan Terimakasih
Terimakasih buat dosenku yang amat sangat "bijaksana",
yang telah memberiku nilai JELEK. Saya merasa bangga
dan sungguh-sungguh bangga terhadap dosenku itu.
Sekali lagi saya ucapkan terimakasih!.
Semoga mereka tetap di STIKI.
buat teman-teman, ma'af mengganggu.

Macro.Word97.Trojan.Thief

Description Macro.Word97.Trojan.Thief

This Trojan uses remote template vulnerability of MS Word 97. The URL is sent to some IRC channels that contain a HTML file that automatically loads and opens an MS Word document that contains reference to another MS Word template-containing Trojan macro. MS Word opens this template without any warnings.
This Trojan macro steals information from the system registry. It extracts the registered name and company of a Windows user, information about AOL users registered on this computer, and also account information of the Internet Account Manager. The collected information the Trojan sends to a site on the Internet.

Home