Macro.Word.Akay
Description Macro.Word.Akay
This is an encrypted macro virus. The virus replicate on opening files (AutoOpen). It contains four original macros, that are copied to six macros during infections:
Documents NORMAL.DOT
Macro1 AutoExec AutoExec
AsliAutoExec AsliAutoExec
Macro2 FileOpenx FileOpen
Macro3 AutoOpen FileOpenx
AutoOpenx
Macro4 AntiMacrosVirus AntiMacrosVirus
While installing the virus searches for 42 macros of other viruses and deletes them. On each start the virus displays the MessageBox:
Created By Akay Inc.
Microsoft Anti-Virus Protection version 1.0
Check other viruses! Be aware! Use Antiviral Software
Demon.348
Description Demon.348
These are harmless not memory resident parasitic viruses. They search for .COM-files of current directory and C:COMMAND.COM file and write themselves at their ends. They contain the internal text string:
_=-DEMON-=_
Demon3b.4313
Description Demon3b.4313
These are dangerous memory resident stealth and polymorphic parasitic viruses. They hook INT 21h and write themselves to the end of COM and EXE files that are accessed. The viruses use quite complex stealth routine (including disinfection of the files in some cases).
Demon3b.4313,4390
These are very dangerous viruses. They have several errors and may halt the system or corrupt the files while infecting them. The viruses contain the texts:
"Demon3b.4313": [demon4] Hellfire
"Demon3b.4390": [demon4] BETA! DONT DISTRIBUTE Hellfire
"Demon3b.4390" displays:
Demon4 is Watchingall
Demon3b.4767,5670
These viruses delete anti-virus checksum files, disable tracing, avoid infection of some anti-virus programs. While accessing to write-protected disks the viruses display the message:
Disk is Write Protected
Please Unprotect it AND
Press any key to continue . . .
The viruses contain more text strings:
TBDRVXXX bc *
CHKDSK.EXE ZIP.EXE ARJ.EXE SCANDISK.EXE DEFRAG.EXE
SCANANTIVIRAV.AN.F-PROT.EXETBDRIVER.EXENAVTSR
VSAFE.COMTBSETUP.EXETBUTIL.EXEVSHIELD.EXE
[demon3b] Hellfire
|