Virus Database

Macro.Word.Alex.c

Description Macro.Word.Alex.c

This is an encrypted Chinese Word macro virus. It contains from three to five macros depending on the virus version: autonew, autoopen, autoclose, toolsmacro. It also contains empty macro:
CONAIR
The virus replicates itself when documents are created (autonew), opened (autoopen) or closed (autoopen). Depending on the current day it erases the files on the C: disk.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Gelap

Description Macro.Word97.Gelap

It is stealth macro virus. It contains seven macros in one module "AuAhGelap": AutoOpen, AutoClose, Au, Ah, ToolsMacro, Gelap, ViewVBCode.
It infects the global macros area on opening an infected document (AutoOpen) and infects other documents on opening and closing (AutoOpen, AutoClose).
The virus turns off the Word virus protection (the VirusProtection option). It also disables the Tools/Macro menus and Visual Basic Editor (stealth).
Before infection the virus checks user name and if it is not "Sembako" displays the baloon:
Hello <UserName>
Sorry, but your Microsoft Word doesn't belong to you any more.
Now it is mine!!

After that the virus changes user name to "Sembako" and user initials to "SBK".
Between 8:00am and 9:00am the virus displays the message:
Selamat pagi
Selamat pagi cewek-cewek yang cakep-cakep.

Between 12:00pm and 2:00pm the it displays:
Selamat siang .
Hallo cewek-cewek, udah pada makan siang belum ?
Sekarang udah jam <current time> loh. Salam sayang buat kamu
semua dari my creator.

After 5:00pm it displays:
Selamat sore.
Hallo cewek-cewek, kok belum pulang sih?
Sekarang udah jam <current time> loh. Eh, ada salam dari my creator.

On April 18th the virus sets the password "!@#$%BoMoH!@#$%" for active document and inserts into document the text:
Happy birthday to my Creator!

Macro.Word97.Gipsy

Description Macro.Word97.Gipsy

It contains six macros in one module "GIPSY": AutoOpen, Payload, FileSaveAs, FilePrint, ViewVBCode, ToolsMacro. It infecting the global macros area on opening an infected file. It infects other documents on saving them with new names.
The Payload macro depending on the system random counter either displays the Balloon:
The Gipsy Virus:
Copy me, I like to travel

For appends to the C:AUTOEXEC.BAT the commands that write to the C:COMPUTER.V file the string "Help me I'm sick":
@echo off
echo Help me I'm sick >>C:Computer.V

On December 24th the virus displays the Balloon:
BiologicBeast Virus:
Mary Christmasall don't work at this day

Home