Virus Database

Macro.Word.Defender

Description Macro.Word.Defender

This macro virus contains six macros:
Documents: AutoOpen, Defend, Module1, Module2, Module3, Module4
NORMAL.DOT: FileSaveAs, ToolsMacro, FileOpen, Defender, Module1, Module2

It infects the global macros area on opening an infected document (AutoOpen), and writes itself to documents that are saved with new name (FileSaveAs). While entering the ToolsMacro menu the virus requests for a password. The password is the same as the active document file name.
The virus disables several viruses or warns a user: while infecting a document or NORMAL.DOT the virus checks it for "Concept" virus macros and several other macros, then it deletes them. Depending on several conditions the virus displays the MessageBoxes:
Defender
ALERT! Autorunning macro (possibly virus)
detected in document. Press OK to disable
Defender
WARNING: Active macro virus found. Defender will now exit Word.
You must then restart Word and try to load the document again

The virus contains the comments:
*****************************************************************
Macro : Defender
Created : August 29, 1995 (modified on October 1 1996)
Copyright (c) 1995 Microsoft Corp.
Description : On FileOpen, detect documents containing autorunning
macros and remove them
*****************************************************************

Check other viruses! Be aware! Use Antiviral Software

Del5th.773

Description Del5th.773

It is a very dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of .COM files that are executed. The virus deletes every 5th file that is opened except *.386, *.COM, *.DLL, *.DRV, *.EXE and *.OV?.

Deliver.BlueShark.1771

Description Deliver.BlueShark.1771

This is a dangerous memory resident encrypted parasitic viruses. It hooks INT 21h and writes itself at the end of EXE-files are accessed. On November, 1st it overwrites the hard drive sectors with the strings:
! MAYBE ONE DAY WE BE UNITED !
then it plays the tune, displays the US national flag and the message:
!!! MY NAME IS DISKDELIVER * THIS IS ONLY BEGIN * I BE BACK !!!
It also contains the internal string:
""" CREATED BY BLUE SHARK - FINISHED 7.VIII.1994 15:30 - CIESZYN POLAND """

Home