Macro.Word.Bertik
Description Macro.Word.Bertik
This is an encrypted macro virus. It contains four macros that have different names in infected documents and NORMAL.DOT:
Documents NORMAL.DOT
AutoOpen YYYAO
XXXAO AutoOpen
XXXFSA FileSaveAs
XXXFS FileSave
PayLoad PayLoad
The virus infects the system on opening an infected document (AutoOpen) and writes itself to other documents on opening and saving (AutoOpen, FileSave, FileSaveAs).
On each infection the virus copies the WINWORD.HLP file to TEMPLATES
.WRD file, where 'n' in number of infection. In case of error the virus displays one of MessageBoxes:
DúleOitè upozornini
!!! Tohle zpùsobil virus Bertik.1 !!!
!!! Made by virus Bertik.1 !!!
Check other viruses! Be aware! Use Antiviral Software
SuperVirus.1175
Description SuperVirus.1175
It is a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed. Depending on the system date the virus corrupts the disk sectors. The virus contains the text string:
Super F-117 Virus 93/03
Supervisor family
Description Supervisor family
These are not dangerous(?) memory resident parasitic viruses. They hook INT 8, 9, 21h, 28h and write themsleves to the end of .COM and EXE files that are executed or opened, "Supervisor.1256,1448" infect .COM files only, "Supervisor.2221" infects both COM and EXE.
The viruses manifest themselves with some video effect. In some cases they perform several Novell Netware calls (to obtain the netware passwords?). The viruses contain the text strings:
SERVER SERVER SECURITY_EQUALS SERVER PASSWORD
SERVER SECURITY_EQUALS SUPERVISOR
MsDos
|