Virus Database

Macro.Word.Emperor.a

Description Macro.Word.Emperor.a

This is a encrypted Chinese macro-virus that replicates itself only under the Chinese Word version.
This virus contains five macros: AutoOpen, Emperor, VirusMessage, FileTemplates, ToolsMacro (stealth). Upon opening an infected document (AutoOpen), the virus infects all current Word windows (i.e., all files that are edited). Upon entering the Tools/Macro menu, the virus erases all macros in NORMAL.DOT, and summons AutoOpen (infection routine).
Depending on the random counter and the day of week, the virus displays the following in the MessageBoxes (partly in Chinese):
The First Emperor Ver 1.00
The First Emperor Ver 1.00
SSCAN,GSCAN,MacroTrap

Check other viruses! Be aware! Use Antiviral Software

Muhamor.4608

Description Muhamor.4608

It is a dangerous memory resident polymorphic double-encrypted parasitic virus. It hooks INT 12h, 21h and writes itself to the beginning of COM and to the middle of EXE files that are executed or opened. The virus has bugs and may corrupt EXE files while infecting them. The virus does not infect files with names: *WE?.*, *AN?.*, *38?.*.
Depending on its internal random counter the virus patches the standard Windows95 logos "Please wait while your computer shuts down" and "It's now safe to turn off your computer" - it writes to the top of these logos an image of fly-agaric mushroom ("muhomor" in Russian).

The virus contains the text strings:
.E.C.e.cXEOMxeom
weANanaNAnWE38
Muhamor virus ver 1.1
Version 1.1
C:WINDOWSLOGOS.sys
C:WINDOWSLOGOW.sys

Mul.443

Description Mul.443

It is a harmless memory resident multipartite virus. When an infected file is executed, the virus writes itself to the MBR of the hard drive. While loading from infected disk the virus hooks INT 1Ch, waits for DOS loading, hooks INT 21h and then writes itself to the end of COM and EXE files that are executed. The virus does not manifest itself in any way.

Home