Virus Database

Macro.Word.DarkSide

Description Macro.Word.DarkSide

This is not a dangerous encrypted Word macro virus. It is related to the "MDMA" virus. It contains four macros: AutoClose, DarkSide1, HerramMacro, ToolsMacro. It infects the documents and the global macros area on AutoClose call.
The virus disables Tools/Macro menu (Herram/Macro in Spanish). It creates on disks the DARKSIDE.1 files and writes the texts to there:
ATENCION: esta computadora ha sido infectada!. DarkSide1 sin una
computadora es como Billy The Kid sin un revolver! ! . . . Virus DarkSide1
creado en la ciudad de Lima en enero de 1997 -=] DarkSide1 Is a peruvian
virus writer [=-

The virus also contains the REMarked comments:
DarkSide1 is in the wild!!! :-)
DarkSide1's E-Mail: virology@usa.net
DarkSide1's live in Peru!!

Macro.Word.DarkSide.b
This encrypted virus contains three macros: AutoClose, DarkSide1B, HerramMacro. It creates the DARKSIDE.NEW file in current directory on C: drive and writes the text to there:
DarkSide1 is Back!!
The name of this macrovirus is DarkSide1.B
Caro's name Dark.A ?! Caro Sucks!! :)
And rememberall DarkSide1 whitout a computer is like...
Billy the Kid without a gun!! :)
WM.DarkSide1.B] by DarkSide1 in Lima Peru 1997

The HerramMacro macro contain the texts:
it's only a clean macro :) very easy !!
DarkSide1 is Cool Macro Virus Writer :)
I like the macrovirii scene...rocks!! :)

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Lucifer

Description Macro.Word.Lucifer

This is an encrypted Word macro virus. It contains three macros in documents: Close, Lucifer, AutoOpen. In NORMAL.DOT it contains six macros: AutoOpen, AutoClose, Close, ToolsMacro (stealth), FileTemplates, Lucifer.
The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are closed (AutoClose).
On 15th of any month the virus copies the C:AUTOEXEC.BAT file to C:AUTOEXEC.LUS and writes to AUTOEXEC.BAT the commands:
@Echo Off"
CDWINDOWS"
Ren *.dll *.lus"
CDWINDOWSSYSTEM"
Ren *.dll *.lus"
CD"
Ren C:AUTOEXEC.LUS C:AOTUEXEC.BAT

It then displays the message and a BMP-picture:
Code Name : Lucifer
Again!!!, from Darkside on Yogyakarta
I'll cross your heart !!
lucifer@Sulthans_Palace.com

On entering the Tools/Macro menu the virus displays the DialogBox:
Message from Lucifer
We knew that the first WordMacro virus was created by McNamara.
But, somebody tried to convince that he was the conceptor!!
His name is: MILKY WAHYUDI WIDJAJA
His speech like bullshit!!
I'm the one of MV creator call him VIRUS CLAIMER, NOT VIRUS MAKER !!
isn't he Phardera ?
Greeting to Everyone
Notice : this is not a virus, just a message don't kill me!!

Macro.Word.Lunar

Description Macro.Word.Lunar

This is an encrypted macro virus. It contains seven macros: autoexec, autoopen, filesave, autoclose, filesaveas, toolsmacro, filetemplates.
The virus infects the global macros area on opening (AutoOpen) or closing (AutoClose) an infected document. It infects the documents that are saved (FileSave) or saved with new name (FileSaveAs).
The virus creates the LUNAR.INI file and writes the text to there:
[virus]
lunar=<number of generation>
author=Hyperlock

This is a stealth-virus - it hooks File/Templates and Tools/Macro, on entering these menus the virus displays the MessageBox:
Microsoft Word
Not enough memory to perform this operation

The virus contains the commented text strings:
WM.Lunar virus
AutoExec macro

Home