Virus Database

Macro.Word.EC

Description Macro.Word.EC

This virus contains three macros: aaaaa, AutoOpen, AutoClose. It infect the global macros area (NORMAL.DOT) on opening an infected document and writes itself to documents that are closed. To prevent duplicate infection the virus check its presence by "aaaaa" macro. The virus does not manifest itself in any way. The "aaaaa" macro contains 13 "EditClear" instructions.

Check other viruses! Be aware! Use Antiviral Software

Rlyeh.1178

Description Rlyeh.1178

It is a very dangerous nonmemory resident encrypted overwriting virus. It searches for COM files, then overwrites them. The virus displays the text:
+----------------------+-------------------------------------------------------+
| _ | Ph'nglui mglw'nafh Cthulhu R'lyeh wagn'nagl fhtagn. |
| /\___[X]___/ | In his house in R'lyeh dead Cthulhu waits dreaming. |
| / /| +-------------------------------------------------------+
| / / / | This virus demonstrates interrupt trapping, anti- |
| /\/ | |/ // | heuristic code, EXE/COM determination, executable |
| || || | data statements, heap use, code length determination, |
| _|| ||_ | simple (XOR) encryption, and overwriting replication. |
+----------------------+-------------------------------------------------------+
| FOR DEMONSTRATIONAL AND EDUCATIONAL PURPOSES ONLY · NOT FOR PUBLIC RELEASE |
+------------------------------------------------------------------------------+
ERROR: No infectable files found!
ACTIVE: Infection in

RMC.1551

Description RMC.1551

It is a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of .COM and .EXE files that are executed or opened. On February, 16th it halts the computer and displays the message:
_ _ _ __ __ _ _ __ _ __ ___ _ _ __ _ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
___ ___ __ __ _ _ __ _ __ _ ___ _ _ ___ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _ _ _ _ _ _ __ _ _ _ _ _ _ __ _ _ _
_ _ _ __ ___ ___ _ _
___ _ _ _ _ _ _ _ _
_ _ _ __ _ __ ___ _
_ _ _ _ _ _ _ _ _
_ _ _ _ _ ___ ___ _ _ _
THIS VIRUS WAS MADE BY RACASAN MIRCEA AND TODAY IS HIS BIRTHDAY.
SO, GO AHEAD AND CELEBRATE, AND IF YOU WANT TO WRITE HIM, HERE IS
HIS ADDRESS :
LEODINGER STRAßE 1/11
A-4050 TRAUN
ÖSTERREICH

The virus also contains the ID-string:
RMC16277

Home