Virus Database

Macro.Word.Blash

Description Macro.Word.Bilbo

This macro virus contains six macros: FileOpen, FileSave, FileExit, AutoOpen, AutoExec, and Bilbo. It infects the documents and global macros area on FileSave and AutoOpen. Starting from the 10th of each month, this virus, on AutoExit, displays a MessageBox with the following text:
Bilbo Baggins was here!

Check other viruses! Be aware! Use Antiviral Software

LightNing.4251

Description LightNing.4251

It is a very dangerous memory resident parasitic polymorphic virus. It hooks INT 13h, 21h and writes itself to the end of COM and EXE files that are executed, opened, renamed or when file's attributes are accessed. The virus does not infect anti-viruses AIDSTEST, DRWEB, -V (former AVP), ADINF, SCAN and ANTI*.
When .PAS files are opened (Pascal source files), the virus searches for "BEGIN" string within a .PAS file and inserts a line of source code that either reboots the computer, or halts it:
inline($b9/$02/$00/$e2/$fb);
inline($ea/$f0/$ff/$00/$f0);

By hooking INT 13h the virus encrypts the sectors that contain text data. The virus contains the text strings:
"LightNing" (c) 12.95 by ML, Krasnodar
MetaMorphic Generator (MMG) v1.0
AIDRWE-VADSCAN

Lilith

Description Lilith

It is not a dangerous memory resident polymorphic and stealth boot virus. To hook INT 13h the virus scans the BIOS code for INT 18h call (CDh 18h), sets INT 13h to that address and hooks INT 18h. Then the virus writes itself to boot sector of the floppy disks and the MBR of the hard drive. Depending on the system timer the virus also hooks INT 5 (Print Screen) and when PrintScreen key is pressed, the virus displays:
L · I · L · I · T · H
Tu del creato prima Donna
del Sesso Maestra infernale
accogli le Nostre dannate Carni
nel Tuo satanico Ventre

The virus also contains the text string:
Milan Italy 95

Home