Macro.Office.Confused
Description Macro.Office.Confused
This multi-platform macro-virus infects Office97 components: Word documents and Excel workbooks and sheets. The virus contains two auto-macros in Excel sheets and Word documents: Document_Close and Workbook_Deactivate. The virus is Chinese (Taiwan) specific and cannot replicate under other MS Office releases.
The virus replicates itself in Excel on de-activating workbooks, and in Word, the virus infects documents that are being closed. The virus also replicates from Excel workbooks to Word documents (if a Word application is active), as well as from Word documents to Excel workbooks (if Excel is active).
The virus contains the "copyright" text:
Copyright (C) 1998 by FlyShadow ~^^~ - Confused Memories
Check other viruses! Be aware! Use Antiviral Software
GreenBios.1131
Description GreenBios.1131
This is a dangerous non-memory resident parasitic virus. It searches for COM files in the current directory and directories that are marked in PATH, then writes itself to the beginning of all files that are found. The virus does not infect the COMMAND.COM file. It also checks/scans the BIOS for the string:
40-P101-001437-00101111-072594-GREEN
and immediately returns to the host program if that string is found.
On Friday the 13th, the virus leaves a memory resident program that hooks INT 1Ch and "shakes" the screen. If the date and month correspond in number, e.g. January 1 (1/1), the virus erases the CMOS.
GreenMonster.711
Description GreenMonster.711
These are memory resident parasitic viruses. "GreenMonster.784" is an encrypted virus. They hook INT 21h and write themselves to the end of .COM files that are executed or opened. The viruses contain the text string:
Green Monster. I"m happy
"GreenMonster.711" is a dangerous virus. Depending on its internal counter it formats the disk sectors.
"GreenMonster.784" does not manifest itself.
|