Macro.Word.Fert
Description Macro.Word.Fert
This macro virus contain five macros: AutoOpen, AutoClose, FileSave, FilePrint, FileSaveAs. On opening infected document the virus copies own macros to global macros area. It infects documents on their saving and saving with new name. On opening documents the virus displays the message:
4x4 vakcina
Hİ Haver! Az İn nevem Szunyãg!
Olyan a vrusvİdelmed, ak¡r az ement¡li! Ez itt
pedig egy 4x4 nevë vrus vakcinaverziãja! Ez
azt jelenti, hogy a vrus eme verziãja nem tud
rombolni, de szaporodni azt tud.
Szerintem azİrt az ilyesmire İredemes odafigyelni!
On document closing the virus displays another one message:
4x4 vakcina
Ne felejtsd el:
A vrusvİdelemre oda kell figyelni!
The virus code contain comment:
Csak vakcinaverziã!
Check other viruses! Be aware! Use Antiviral Software
Hero.394
Description Hero.394
These are not dangerous memory resident parasitic viruses. They copy themselves to the Interrupt Vectors Table at the address 0000:0200, hook INT 21h, and write themselves to the end of the files that are executed.
"Hero.394" infects only EXE files, "Hero.506" infects both EXE and COM files. As a read/write buffer these viruses use video memory.
While setting Interrupt Vector (INT 21h, AH=25h) with a number greater than 7Fh, "Hero.506" disinfects itself in the memory.
On the 1st of any month these viruses decrypts and display the following messages in Russian: "GLORY TO HEROES!" or "The author of the virus is a cretin" depending on the version of the virus.
Hex
Description Hex
It's a harmless memory resident boot virus. It hooks INT 13h and writes itself into MBR of hard drive and boot sector of floppy disks. It contains the internal text strings:
CocaColato jest to!
Wirus HEX dedykowany E.D. i M.Sellowi
|
Home
Viruses from A to Z
0-9
A
B
Ñ
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Z
Ocab I Sundsvall Aktiebolag
TandlÄkare TorbjÖrn ÅhstrÖm Ab
Jany Logy Songs
Marianne Åbergs Frisersalong
GlasÖgonnetto Aktiebolag
|