Virus Database

Macro.Excel97.Police.a

Description Macro.Excel97.Police.a

This Excel97 macro virus is related to "Macro.Excel.Laroux". It infects Excel worksheets (XLS files). It contains one module "Police" and four subroutines in it: Auto_Open, action, Auto_Close, effect.
On opening an infected file macro auto_open is executed. It copies virus into new file FUCKPOL.XLM in StartupPath Excel and as a result infects Excel. The virus then defines macros Fuck as handler of sheet activation procedure, as a result the virus intercepts sheets opening and infects them.
The virus deletes menu items (stealth): Tools/Macro, Tools/Customizeall, View/Toolbars, View/Status Bar, Window/Unhide...
On opening any sheet on 1st, 13th, 31st of any month the virus removes current sheet and displays Balloons (see below). These Balloons are not displayed, if application variables UserName = "foxz" and OrganizationName = "NoMercyVirusTeam". It seems that the virus author protected itself by this trick. The texts inside Balloons look as follows:
XM97.Fucking Police
Six students of Universitas Trisakti, Jakarta, died from bullets fired by
security personnel during an action of concern staged by thousands of
students at the campus of Universitas Trisakti, Grogol, West Jakarta, on
Tuesday (12/5). The six students were shot while on campus by a flurry of
bullets, suspected to be fired by security troops on the Grogol fly-over.
Dozens of other students suffered serious and minor injuries.
XM97.Fucking Police
Until this report was prepared, around 200 students were still waiting in
the corridors of the Sumber Waras Hospital, guarding their fellow-students
still being treated in the Emergency Unit, as well as the remains of their
colleagues laying in state. A moving atmosphere prevailed around the
morgue, resounding with the shrieks and crying of the victims' relatives
(text by kompas online)
I hate You !!
Bwahahn.n.n, die you lamer!

Check other viruses! Be aware! Use Antiviral Software

AdiPop.485

Description AdiPop.485

It is a dangerous memory resident parasitic virus. It copies itself into Interrupt Vectors Table, hooks INT 1Ch, 21h and writes itself to the end of COM files that are executed. Depending on its counters the virus hooks INT 9 and beeps by PC speaker. The virus has bugs and may halt the system.

Adolf.475

Description Adolf.475

It is a very dangerous memory resident virus that by standard way hits COM- and OVL-files at they loading into memory. The virus copies its TSR part into interrupt vector table at address 0000:0200. It contains a text "Adolf Hitler". With a probability of 1/8 it stops a file deleting, hooks INT 21h.

Home