Virus Database

Macro.Excel.Ultras.Cobra2

Description Macro.Excel.Ultras.Cobra2

This virus infects Excel worksheets. It contains one module "Sheet?" where '?' is '3' or '5' depending on the virus version. The "Sheet?" module contains auto-functions Auto_Open and Auto_Close. The virus module also contains the functions:
TIMER, Trojan
The virus infects the system and files upon opening and closing. It also creates an infected file in the Excel Startup directory, the file name is PERSONAL.XLS or PERSONAL.XLM depending on the virus version.
The viruses delete the Tools/Macro menu (stealth) and anti-virus programs:
C:Program FilesAntiViral Toolkit Pro*.*
C:Program FilesFindVirus*.*
C:f-macro*.*
C:Program FilesCommand SoftwareF-PROT95*.*
C:Program FilesMcAfeeVirusScan*.*
C:Program FilesNorton AntiVirus*.*
On the 4th of any month, the virus writes the commands that format the hard drive to the AUTOEXEC.BAT file . On the 14th of any month, it deletes the C:WINDOWSREGEDIT.EXE file and displays the MessageBox:
ULTRAS
You Infected XM.Trojan.COBRA by ULTRAS
On the 26th of any month, it displays the same MessageBox and deletes the files:
C:WINDOWSSYSTEM.DAT, C:WINDOWSSYSTEM.DA0.
The virus, depending on the current day, appends the instruction that formats the hard drive to the C:AUTOEXEC.BAT file.

Check other viruses! Be aware! Use Antiviral Software

Kelly.779

Description Kelly.779

It is not a dangerous nonmemory resident encrypted parasitic virus. It searches for .COM files, then writes itself to the end of the file. On Tuesdays 20th it hooks INT 1Ch and manifest itself by a video effect. The virus contains the text:
Just a messageall a simple message to put in a virus... argh...
what am I going to write here... yeah... maybe the name of the
virus, I am tired of those shitty names! Callme [Kelly]. OK?

Kemerovo.a

Description Kemerovo.a

These are dangerous nonmemory resident parasitic viruses. They search for .COM files of the current directory, then write themselves to the end of the file, and Jmp-Virus instructions (four bytes: XCHG AX,DX; JMP Loc_Virus) to the file header. Depending on the system timer these viruses might reboot the computer. They contain the string ".COM". On an attempt to infect they open the files and might left them opened.

Home