Virus Database


Macro.Excel.Ninja

Description Macro.Excel.Ninja

This virus infects Excel spread sheets (XLS files). It contains one module, "Ninja," that has two functions: "auto_open" and "Infect_Ninja".
The virus "auto_open" macro contains just one command that defines the "Infect_Ninja" macro as a handler of the OnSheetActivate routine. As a result, the virus hooks sheets activation, and, while opening a sheet, the virus (the Infect_Ninja macro) takes control.
When the Infect_Ninja macro takes control, it searches for NINJA.XLS files in the Excel Startup directory and checks the count of modules in the current Workbook.
If the infected macro is an active Workbook and the NINJA.XLS file does not exist in the Excel Startup directory, the virus decides that it is being executed for the first time. The virus then creates the NINJA.XLS file in the Excel Startup directory and saves its code to it by using the "Save As" command.
When Excel loads its modules the next time, it automatically loads all XLS files from the Startup directory. The infected NINJA.XLS is loaded as well as other files, and the virus takes control and hooks the sheet activation routine.
If the NINJA.XLS file exists in the Excel directory, the virus copies its code to the active Workbook. As a result, the active Workbook is infected.

Check other viruses! Be aware! Use Antiviral Software

Polish.1769

Description Polish.1769

It is a harmless memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed or opened. The virus does not manifest itself in any way.

Polonaise Family

Description Polonaise Family

These are not dangerous memory resident parasitic viruses. They hook INT 21h and write themselves to the end of EXE files that are executed or closed. When an infected file is opened, the virus disinfect it. Depending on the system time they play a music.
"Polonaise.812" infects COM and EXE files that are executed, it does not manifest itself in any way.
"Polonaise.812,2502" contain the strings:
WIZARD
!C

Home

Viruses from A to Z
0-9 A B Ñ D E F G H I J
K L M N O P Q R S T
U V W X Y Z




    Copyright © 2005 Virus-Database.com
© 2005 Virus-Database.com