Virus Database

Macro.Word.Allian

Description Macro.Word.Allian

This is encrypted macro virus. It contains two macros that have identical code inside: AutoOpen, AutoNew. The virus infects the global macros area and documents on opening an existing document or creating a new document. After infecting the virus displays the message:
UNIVERSITI TEKNOLOGI MALAYSIA
ARE YOU A FSKSM STUDENT?
ANSWER YES OR YOUR DOCUMENT WILL BE LOCKED BY MY PASSWORD !
FAKULTI SAINS KOMPUTER DAN SISTEM MAKLUMAT

If a user answers "Yes" the virus sets the password "Saya!" for the current document.

Check other viruses! Be aware! Use Antiviral Software

Tcp.407

Description Tcp.407

It is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed. The virus does not manifest itself in any way. It contains the text:
[Baby Bug, Tcp/29A]

TD.1536

Description TD.1536
It is not a dangerous memory resident multipartite virus. It writes itself to the end of COM and EXE files, to the MBR of the hard drive and to the boot sector of floppy disks. The virus does not manifest itself by any sound or video effect. It was named after its ID-text "TD" that presents in infected files, boot and MBR sectors.
When an infected file is executed, the virus infects the MBR of the hard drive, hooks INT 21h and stays memory resident. It then affects files that are executed. The virus pays attention to Windows self-checking signature ENUNS that presents at the end of Windows COM files and patches it. While installing memory resident the virus also infects the C:WINDOWSWIN.COM file and deletes the C:WINDOWSSYSTEMIOSUBSYSHSFLOP.PDR file, if they exist.
On loading from infected disk the virus hooks INT 13h, 1Ch, waits for DOS loading process and then hooks INT 21h. By hooking INT 13h the virus infects floppy disks, INT 13h handler also has stealth routine that is activated on accessing to already infected disks.

Home