Virus Database

Macro.Office97.Toraja

Description Macro.Office97.Toraja

This macro-virus infects two MS Office applications: Word documents and Excel Office 97 datasheets. For document compatibility, Office 97 uses Visual Basic Script, which is contained in both Word and Excel files.
Upon opening, the virus infects the system, documents and sheets (AutoOpen macros in Word and Auto_Open in Excel). Upon infection, the virus utilizes the Office 97 functions for importing/exporting (reading/writing) the virus code via the text file, copies its exit code to the text, and then imports it to the infected object.
Upon exiting Word (Auto Exit), Excel is attempted to be infected. The virus performs a DDE-exchange: it starts up Excel with a minimized window and transfers all the information and commands necessary for creating the AutoRecover17.XLS infected file in the Excel start-up directory here. Word infection resulting from Excel occurs in a similar way upon opening a datasheet (Auto_Open). The virus starts up Word with a minimized window, opens Visual Basic Editor, and obtains the virus code from the AutoRevolver17.dat file.
The virus contains the following copyright string:
Created : Toraja High Land 1998 by Marsel - Lina
Modified : July 1999

Check other viruses! Be aware! Use Antiviral Software

Kupps.215

Description Kupps.215

It is a harmless memory resident parasitic virus. It copies itself to the Interrupt Vectors Table, hooks INT 21h and writes itself to the end of COM files that are executed. It contains the text string:
KupPS

Kurgan.919

Description Kurgan.919

These are not dangerous memory resident parasitic viruses. They hook INT 1Ch, 21h and write themselves to the end of COM and EXE files that are executed or opened. The length of COMMAND.COM file does not grow, these viruses write themselves at the zero-bytes area to the end of that file (see Lehigh virus). They contain the text "command". By hooking INT 1Ch they manifest themselves by different manners:
"Kurgan.919" changes keyboard flags;
"Kurgan.948" alters text symbols on the screen;
"Kurgan.1624,1654" drop the letters on the screen as "Cascade" virus does.

Home