Asmodeous Family
Description Asmodeous Family
These are dangerous memory resident encrypted parasitic viruses. They hook INT 21h and write themselves into the middle of COM and EXE files that are executed or opened.
The viruses are divided into 10 blocks of code. While infection the viruses rearrange these blocks in randomly selected order (see "Badboy" viruses).
On November 11th these viruses delete the files when FindFirst/Next (AH=4Eh,4Fh) DOS calls are performed.
The viruses contain the internal text strings:
"Asmodeous.1160": ASMODEOUS
"Asmodeous.1343,1829,1833": Asmodeous
"Asmodeous.1437,1450": Asmodeous 9C
Check other viruses! Be aware! Use Antiviral Software
Macro.Word97.Horn
Description Macro.Word97.Horn
This virus contains two macros: AutoOpen, LittleHorn. The virus infects the system on opening an infected document. It infects the document on "e" keystroke - to do that the virus installs its infection macro LittleHorn as "e" keystroke handler.
The virus does not manifest itself in any way.
Macro.Word97.Hubad
Description Macro.Word97.Hubad
The virus spreads in Word documents. When an infected document is opened the virus gains control and infects the global macros area (Normal.dot template). Other documents are infected upon their opening or closing.
The virus has a payload routine that is executed upon document printing. This procedure, before printing a document, inserts at the current cursor position a symbolic picture of women, and removes this picture just after printing. So this picture appears only on paper.
|