Virus Database

Macro.Word.Eraser

Description Macro.Word.Eraser

These are very dangerous encrypted China-Word specific macro viruses. "Eraser.a" contains 8 macros: ERASER, AutoOpen, FileNew, FileOpen, ZlockMacro, Games, ToolsMacro. "Eraser.b" contains 7 macros: CKE, AutoOpen, FileNew, FileOpen, ZlockMacro, ToolsMacro, FileTemplates.
Only one macro (FileOpen) contains the infection routine, other macros contain the trigger routines.
Eraser.b
On FileTemplates call, the virus runs the DOS command "echo y|format c:/u". On ToolsMacro call, the virus beeps three times and drops and launches DOS multipartite virus "Hare.7786" and DOS parasitic virus "Europe.421". Depending on the system date the virus appends to the C:AUTOEXEC.BAT file the command:
FORMAT C:/S/U/V:CKE>NUL

The virus displays MessageBoxes in Chinese with the string:
Chungking Express Macro Virus

Check other viruses! Be aware! Use Antiviral Software

Crawly.6624

Description Crawly.6624

It's a not dangerous not memory resident companion virus that searches for .EXE-files and creates the companion .COM-files which contain the virus body. Sometimes it plays the tune and types: "The Creepy Crawly".

Crazy.1402

Description Crazy.1402

These are harmless memory-resident stealth viruses that infect COM-files as a program is terminated (the Exit and Keep DOS functions), files are being searched (FindFirst and FindNext) or a file is closed. The viruses decreases the memory area allocated for DOS (the word at the address 0000:0413). They hook 12 DOS functions and use stealth mechanism: recover infected files as they are accessed. Upon installation the viruses create in RAM two own copies: operational and backup ones. On every call to the 1Ch interrupt (Timer Tick) "Crazy" viruses write their backup copies at the address of its operational copies and in such a way gets rid of debuggers. The viruses hook INT 1Ch, 21h and contain the text:
"Crazy.1402" - Crazy imp. v1.5
"Crazy.1445" - Crazy imp. v2.0

Home