Virus Database

Macro.Excel97.War

Description Macro.Excel97.War

This is Excel97 macro virus. It hooks sheets activation event and infects corresponding files. It also creates the infected file ALEVIRUSCS.XLM in the Excel startup directory and disables the Macro Virus Protection by running a short macro in a temporary MS Word application that is executed by the virus in hidden window.
The virus uses procedure from the "Macro.Excel97.Papa" virus to send own copies via e-mail, but in contrast to Papa virus it also infects other workbooks. So, when just infected workbook will be opened next time, this workbook (that may contain confidential information) will be sent to addresses stored in Outlook address book.
The e-mail message has:
Subject:
Fwd: Millions DEADS!!!
Body:
Urgent info inside. The III War is Begin!!! Read The Secret's in XLS!

To the message the infected workbook is attached.
After infection the virus creates the directories:
c:Arquivos de programasMicrosoft OfficeOfficeXLINICIO
c:Programs FilesMicrosoft OfficeOfficeXLINICIO

Latest closed document the virus saves in the "C:WINDOWS" folder with names WAR3.XLS, SEXO.XLS, FONE.XLS, AVP.XLS, CAIXA.XLS.
The virus also tries to replace default script of many popular IRC clients by own one which sends infected workbook to everybody joined to IRC channel.
On May 19th the virus shows office assistent balloon with message:
Aten§£o:
Primeiro Excel97>Email>MIRC> Virus Brasileiro by AlevirusSCS [Brasil]1999!
Em Breve Alevirus Excel97 Formula Virus!Mande-me Um EMAIL!
fernanda88@hotmail.com

The virus blocks Visual Basic Editor hot-key displays message box:
Este programa executou uma instrucao ilegal por favor feche o Windows
e reinicie.

Check other viruses! Be aware! Use Antiviral Software

OneHalf.Madjid.2930

Description OneHalf.Madjid.2930

This virus is not encrypted one, but it encrypts hard drive sectors as well as original OneHalf. This virus displays the text:
OHHHHHall MADJID
Here is very dark.
HELP ME... HELP ME... HELP...
I am here .They kill the love .I am solitary .
Press RETURN for continue

OneMinute.2420

Description OneMinute.2420

It is not a dangerous nonmemory resident parasitic polymorphic virus. It searches for COM and EXE files, then writes itself to the beginning of COM files (except COMMAND.COM) and to the end of EXE files. The virus deletes the anti-virus databases: SMARTCHK.CPS, CHKLIST.CPS, CHKLIST.MS.
On January 1, July 6, September 9 the virus displays the message:
This day in the year 1976,
[xx]
China, had been left us for ever.
Now, in order to express cherish the memory of this great man, let's observe
one minute's silenceall
[yy]
Thank you!

where [xx] is:
January 1: Chou Enlai, Premier of the State Council of
July 6: Chu Te, Chief of the Standing Committee of the
National People's Congress of
September 9: Mao Tsetung, Chairman of the Communist Party of

and [yy] goes down from "60" to "00" according to seconds counter.

Home