Virus Database

Macro.Word.Color (Rainbow, Color Changer)

Description Macro.Word.Color (Rainbow, Color Changer)

This is encrypted virus, it contains the macros:
macros, FileNew, AutoExec, AutoOpen, FileExit,
FileSave, AutoClose, FileSaveAs, ToolsMacro

This virus infects the files while creating of new document (FileNew) and while saving the document with new name (FileSaveAs).
On each 300th call to the file functions (FileNew, AutoOpen, FileExit, FileSave, AutoClose, FileSaveAs and ToolsMacro) the virus alters the section [colors] in the WIN.INI file, and sets the random selected colors for Windows components. New colors appear after next Windows loading. The virus keeps the trigger counter in the WIN.INI file in the [windows] section:
[windows]
countersu= 234

The virus allows executing of Auto-macros (AutoOpen, AutoClose and so on), it sets DisableAutoMacros to zero.
When the virus is active, it is impossible to activate Tools/Macro command. To manual disinfection it is necessary to delete virus' macros by using Organizer (Tools/Customize, Word command, then draw Organizer out to toolbar).

Check other viruses! Be aware! Use Antiviral Software

Disruptor.1129

Description Disruptor.1129

It is not a dangerous memory resident encrypted parasitic virus. It writes itself to the end of EXE files. When an infected file is executed, the virus creates and infects virus-dropping files: STARTME.EXE file in the current directory and README.EXE file in the root directory of the current drive. The virus then returns back to the host program. When STARTME.EXE or README.EXE are executed, the virus displays the message:
SYSERR1764: Not enogh memory to start this program. Try again!

It then hooks INT 21h, stays memory resident and infects EXE files that are executed.
The virus also creates the hidden ION.DAT file in the root directory of the current drive, saves its counter in there and increases this counter on each execution of infected program. If that counter reaches 120, the virus halts the computer (because of a bug this counter never reaches 120). When this counter reaches 60, the virus stays memory resident not only from droppers, but from any infected file.
The virus disables file deleting and subdirectory removing DOS calls. The virus also contains the text strings:
Sector Disruptor II 1001
SDII

Dith.1502

Description Dith.1502

It is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed. The virus does not manifest itself, it contains the text string:
AL-DITH FOREVER

Home