Virus Database

Macro.Excel.Dado.a

Description Macro.Excel.Dado.a

This is an Italian macro-virus infecting Excel sheets. It contains five macros in one module "conciente": auto_abrir, auto_cerrar, infectar, vv1, and contamina.
The virus infects a system by creating an infected PERSONAL.XLM file in the Excel startup directory. To infect other sheets, the virus hooks their activation procedure. Upon closing a file, the virus saves it without any alert messages.
The virus was named after the comment present in the virus macros:
Dado Error IrA terminar

On Fridays at 16:30, the virus displays the MessageBox:
ííí GRACIAS A DIOS ES VIERNES !!!
FAVOR DE APAGAR SU COMPUTADOR Y QUE TENGA UN BUEN FIN DE SEMANA

Check other viruses! Be aware! Use Antiviral Software

SMEG.Pathogen

Description SMEG.Pathogen

This is a dangerous memory-resident parasitic polymorphic virus. It was written by using a SMEG polymorphic engine. It traces and hooks INT 21h, and write itself to the end of COM and EXE files that are executed or opened. While infecting a file, it checks the file name, and does not infects the files with names CO*.*, F-*.*, SC*.*, TB*.*, VI*.*, FS*.*, VP*.*, VS*.*, CL*.*, SM*.*, FL*.*. On Mondays, depending on the system time and its internal counters, the virus erases the CMOS and the disk sectors, and then displays the following message:
Your hard-disk is being corrupted, courtesy of PATHOGEN!
Programmed in the U.K. (Yes, NOT Bulgaria!) [C] The Black Baron 1993-4.
Featuring SMEG v0.1: Simulated Metamorphic Encryption Generator!
'Smoke me a kipper, I`ll be back for breakfastall..'
Unfortunately some of your data won`t!!!!!
It also contains the following text strings:
EXECOM /:.<>+=;,"[]|OC-FCSBTIVSFPVSVLCMSLF
SMEG v0.1

SMEG.Queeg.a

Description SMEG.Queeg.a

This is a dangerous memory-resident parasitic polymorphic virus. It was written by using a SMEG polymorphic engine. It traces and hooks INT 21h, and write itself to the end of COM and EXE files that are executed or opened. It also hooks INT 13h and 20h. While infecting a file, it checks the file name, and does not infects the files with names CO*.*, F-*.*, SC*.*, TB*.*, VI*.*, FS*.*, VP*.*, VS*.*, CL*.*, SM*.*, FL*.*. On Sundays, depending on the system time and its internal counters, the virus erases the CMOS and the disk sectors, and then displays the following message:
+---------------------------+
ƒ -" QUEEG "- ƒ
ƒ ~~~~~ ƒ
ƒ (C) The Black Baron 1994 ƒ
ƒ ƒ
ƒ Featuring: SMEG v0.2 ƒ
ƒ ƒ
ƒ Better than lifeall.. ƒ
+---------------------------+

It also contains the following text strings:
EXECOM /:.<>+=;,"[]|OC-FCSBTIVSFPVSVLCMSLF
SMEG v0.2

Home