Virus Database

Macro.Word.Concept.f

Description Macro.Word.Concept.f

This is a encrypted virus. It contains seven macros: K, a678, PARA, SITE, I8U9Y13, PayLoad, AutoOpen.
On every 16th day of month it replaces '.' to ',' and 'a' to 'e'. On every day of month less then 16th it replaces all texts 'and' to 'not'.
The virus displays a message box with the text:
"Parasite Beta version 0.8!"

or with:
"Your computer is infected with the Parasite Virus, version 1.0!"

Check other viruses! Be aware! Use Antiviral Software

IRC-Worm.Anumps

Description IRC-Worm.Anumps

This worm spreads via IRC channels and infects MS Word documents. The virus itself is a Word document containing a macro named Mumps.
Installation
When opened, the file will:
attempt to disable the Security menu in the Macro menu
disable the ban on activating macros in the Windows system registry
create a file named Mumps.drv in C:Windows directory and writes the code of the macro to this file. This file is then used to infect all open Word documents
save the active document to the hard drive under the following names:
C:WindowsFAQ.doc
C:Program FilesMicrosoft OfficeOfficeSTARTUPMumps.dot
commences propagation via IRC.
Propagation via IRC
The worm modifies a file named script.ini file. This means the file C:WindowsFAQ.doc will automatically be sent to all users of the channel used by the infected computer.
Signs of infection
When the user tries to open the HelpAbout menu, the worm changes the background colour of the document to dark blue. Letters will appear in white. It also open notepad.exe displaying the following text:
"Windows has low memory resources. Please restart your Windowsall.."
If the user tries to print the current document and the system clock is showing 59 seconds, a Message Box with the following text will be displayed:
"Your printer driver is not compatible with Windows. Please install another printer drivers."
If the user tries to view the code of the Macros or open the ToolsMacro menu, a Message Box with the following text will be displayed:
"There is something a trouble with this function..."
Other
The worm attempts to register C:WindowsFAQ.doc in the system registry as the default signature for Microsoft Outlook 5.0. The file will then automatically be added to all outgoing mail.

IRC-Worm.Banishing.2373

Description IRC-Worm.Banishing.2373

This is an mIRC worm combined with a memory resident parasitic stealth DOS virus. The DOS instance, when run, hooks INT 21h, and writes itself to the end of DOS COM and EXE files that are executed or opened. The virus is encrypted in COM and EXE files.
To spread its worm component via mIRC channels, it overwrites the SCRIPT.INI file in the C:MIRC directory with a set of instructions that send this SCRIPT.INI file to the channel upon file sending and receiving as well as to users that are leaving the channel. The worm does not send the infected DOS file to the channel, only to the SCRIPT.INI file.
The infected script also manifests itself with messages: when an infected client connects to a channel, it joins the "virus" channel and sends the following text there:
Will not the mountains quake and hills melt at the coming of the darkness?
Dark Banishing V1.0

If the text "virus" is found in the channel, the worm sends the same message to this channel.
The worm also contains the text strings:
Dark Banishing Version 1.0
Dark Banishing V1.0 By VxFaeRie

Home