Virus Database

Macro.Office.Halfcros.a

Description Macro.Office.Halfcros.a

This is multi-platform macro-virus. It infects two MS Office97 applications: Word documents and Excel sheets. The main part of the virus code is encrypted and placed in the virus body as a random-letters comments. In case of need, the virus gets these comments, decrypts them, convert to the macro instructions and executes them. As a result, the main replication routines are invisible by viewing macro code in the Tools/Macro menu.
In non-encrypted form, there are just a few virus macros present: events hookers and decryption routine. The virus hooks three events: Excel sheets closing, and Word documents opening and closing (Workbook_Deactivate, Document_Open, Document_Close). In all these cases, the virus decrypts and calls the infection routine. The virus also creates the infected BOOK1 Excel sheet in the Excel auto-start directory.
The virus disables the MS Office virus protection by directly accessing the system registry. Starting from 0:10pm till 0:25pm, the virus displays the message box:
Wonder v2.0 by ThE wEiRd GeNiUs
Its time for lunch

where is the name of current user.

Check other viruses! Be aware! Use Antiviral Software

C1992.1536

Description C1992.1536

This is a harmless memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of COM- and EXE-files that are executed or opened. It contains the internal text string:
1992.

CA.815

Description CA.815

It is a dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. The virus does not infect *AN.*, *OT.* and *AN.* files.
Depending on the system time the virus halts the system. The virus contains the text:
[nORThMeNS aNGeR] Coded by C.A, Karlstad, Sweden, 10/96

Home