Virus Database

Macro.Word.Demon

Description Macro.Word.Demon

It contains three macros, two of them have random selected names, the last one is AutoOpen in documents and AutoClose in NORMAL.DOT. To get these random names on infection the virus saves them in document's variables or in WIN.INI file.
To prevent duplicate infections the virus uses the description of the AutoClose macros. In infected files this description contains the string "Protects your computer". To detect itself the virus also creates the section "[I]" in WIN.INI file.
Starting from May and till December the virus removes itself from the system. It there is the text "Dark Master calling" in current document, and it is selected, the virus displays the MessageBox:
Microsoft WinWord DEMON
WINWORD HIDDEN DEMON
is happy to see his MASTER!!!
GREAT DAY !!!
This file is infected as # <¡«¼Ñ »« «½Ñ¡¿ >

Check other viruses! Be aware! Use Antiviral Software

Creeper.569

Description Creeper.569

It is a dangerous nonmemory resident parasitic virus. It searches for .COM files and the C:COMMAND.COM file, then writes itself to the end of the file. The virus deletes CHKLIST.* anti-virus database files, depending on the system time and date it loads new video fonts. The virus contains the text strings:
*.com c:chklist.* c:command.com
The Creeper Virus V2.0

Crepate.1944

Description Crepate.1944

This is dangerous memory resident multipartite encrypted virus. On execution of infected file it infects the current drive: boot sector if the current drive is floppy one, and MBR if it is a hard drive. On loading from infected disk the virus hooks INT 1Ch, waits for DOS loading, hooks INT 21h and writes itself at the end of the COM files that are accessed. Depending on the system timer the viruses erase the disk sectors.
The virus contains the following internal text strings:
Crepa R.T. (c) by MI BRACCOBALDO 1992/93 (CREPA)
Italian Virus Laboratory (PISA) Released 3.0 - REDRUM.
Crepa - R.T.

Home