Virus Database

Macro.Word.Ceefour

Description Macro.Word.Ceefour

This is an encrypted Word macro virus. It contains six macros: AutoOpen, FileSave, FileOpen, FileTemplates, ToolsMacro, CFFSA.
It infects the global macros area on opening or saving an infected document (AutoOpen, FileSave). It writes itself to the documents that are saved with new name (FileSaveAs).
The virus disables the ToolsMacro and FileTemplates menus (stealth). While opening a document the virus checks its name and disables its stealth routine, if the name of document contains the sub-string "TONY".
On April 1st the virus erases the files on the C: drive. The virus contains the comments:
C-4 By Karl
"You are about to have a very bad day."
"It looks like C4 in the mothers arm."
"We are both professional, This is personal."
"And when Alexander saw the bredth of his domain he wept for there
were no more worlds to conquer (benefits of a classical education)"
quotes from the masters!

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Cleanup

Description Macro.Word.Cleanup

This is a Portuguese encrypted macro virus. It contains only one macro AutoOpen and replicates itself on opening documents.
In January in 2000 the virus erases all files on the C: drive, but cancels erasing if any of files presents on disk:
C:DOSMASTERPC.TXT
C:WINDOWSMASTERPC.TXT
C:WINDOWSSYSTEMMASTERPC.TXT

While deleting the virus displays the messages:
SEARCHING TEMPORARY FILE TYPE all
PROBABLE TEMPORARY FILE FOUND
Delete this file
DELETING FILE...
Files Deleted. Keep your Hard Drive cleaned !

Macro.Word.Clock

Description Macro.Word.Clock

This is an encrypted virus. It contains eleven macros: Action, AutoExec, AutoOpen, DateiÖffnen, ExtrasMakro, DateiSchließen, DateiSpeichern, DatumUndUhrzeit, DateiDokVorlagen, DateiAllesSpeichern, DateiSpeichernUnter.
The virus infects the system while opening an infected file (AutoOpen) and infects the files that are opened or saved.
In current day number is above than 25, year is above than 1996, seconds are above than 39, the virus displays the message box containing current date and time.

Home