Virus Database

Macro.Word.Alliance

Description Macro.Word.Alliance

This virus contains only one macro in infected documents - AutoOpen, but while infecting the system it copies it to two macros - AutoOpen and AutoNew. As a result, the virus infects the system on opening an infected document, and infects the documents that are opened or created.
The virus sets Subject in the FileSummaryInfo to:
You Have Been Infected by the Alliance

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Ivana

Description Macro.Word.Ivana

The virus contains seven macros: Bold, Ivana, EditUndo, AutoClose, Underline, ToolsMacro, FileTemplates. It replicates on the documents closing.
If system time seconds value is less than 15, the virus cancels undoing (Edit/Undo calls). On Sunday the virus hides the Formatting ToolsBar, on Monday it hides the ScrollBar.
On 13th of any month the virus adds the text to the end of documents:
Na kraju, samo jos da kazem: volim te, Ivana [by utik]
And finally, I would like to say: I love you, Ivana [by utik]

On July 4th it writes the string "Ivana" to the end of the current document and sets the same password on the document.
The "Ivana" macro contains the comments:
Dedicated to Ivana, the only one
[by utik]

Macro.Word.JackWild

Description Macro.Word.JackWild

Text (c) Michal A. Egler
This is a dangerous macro virus written in Poland. It was found in the wild in the city of Poznan. The virus contains 11 encrypted macros: Utils, AutoNew, FileNew, AutoExec, AutoOpen, FileExit, FileSave, AutoClose, FileSaveAs, ToolsMacro, FileTemplates. The virus code contains many comments. It looks like a beta version of the virus and contains implemented debug functions. In debug mode the virus displays MessageBoxes with error messages and informations about current action. Randomly the virus presents special effects:
SetProfileString "windows", "Programs", "com bat"
SetPrivateProfileString "boot", "shell", Chr$(255) + "progman.exe", " system.ini "
SetPrivateProfileString "ScreenSaver", "Password", " z'*Ge?OnI+*Ku ", "control.ini"
Shell Environment$("COMSPEC") + "/c" + "setver win.com 3.0", 0
SetProfileString "windows", "SwapMouseButtons", "yes" SetProfileString "windows", "MouseTreshold1", "0"
SetProfileString "windows", "MouseTreshold2", "0"
SetProfileString "windows", "MouseSpeed", "0"

Changes colors of many elements in Windows.
The virus also contains the text:
Colors 95 modified by Jack Wild

Home