Virus Database

Macro.Visio.Unstable

Description Macro.Visio.Unstable

This is the second macro-virus that also has pretensions to be The Number One in the "Macro.Visio" family. This virus is more complex than Macro.Visio.Radiant - it uses encryption and special tricks to hide its body in infected files.
The virus infects Visio documents, and stencils and templates upon opening an infected document. It enumerates all opened documents, stencils and templates and infects them by coping the virus body into them. To mark already infected documents, the virus writes "Visio2k.Unstable" into their description and does not infect documents with such a mark.
To hide itself, the virus closes all opened widows in the VBA editor, disables Visual Basic Editor's menus and "Standard" toolbar. In case a user tries to edit the macros inside infected documents, he/she will see just the empty editor's main window without any menus, toolbars and child windows.
The virus has a payload that triggers on the 31st, and it displays the message:
Visio2000.Unstable
Unstable, it's hard to be the one who's strong
Who's always got a shoulder to cry on
Who's got a shoulder for me?

The virus contains three procedures in module "ThisDocument" - "Document_DocumentOpened()", "Unstable()" and "ci()". Inside infected documents second procedure is unreadable because of encryption. The virus decrypts this procedure only just before its call.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.No-F

Description Macro.Word.No-F

This is an encrypted macro virus. It contains only one macro FileClose and infects the global macros area and documents on FileClose call. On closing it also searches for all "fuck" words within current document and replaces them with "f***".

Macro.Word.Nomej

Description Macro.Word.Nomej

The virus code contains six macros: Action, AutoExec, AutoOpen, InNormal, UtilMacro, ArquivoSalvarComo. The virus spreads on opening documents or saving them with new name. This version of virus does not manifest itself in any way. It contains the text:
By Creby & Criby

Home