Virus Database

Macro.Word.Formater

Description Macro.Word.Formater

The virus contains five macros: AutoExec, AutoOpen, DLLError, ToolsMacro, ToolsCustomize. It replicates on opening documents.
In the WIN.INI file in the [Formater] section in the Activated string the virus keeps the counter that is increased on each loading Word with infected NORMAL.DOT.
On starting Word on August 20 the virus creates a new document and runs the text there:
Word Macro Virus Formater!!! by Formater . This is my birthday!
I'm <1998 minus current year number> years old! Don't try to find meall

On entering the Tools/Macro or Tools/Customize menu the virus displays the MessageBox:
Formater
Cannot find FORMATER.DLL. Windows
needs this file to run winword.exe

On entering the same menus on August 20 the virus displays the InputBox and waits for "Formater" input, otherwise it exits the Windows:
Formater
I'm a Word Macro Virus! I said: 'Don't try to find me!!!' You didn't
listen to me! Enter my name, or I will quit from Word without saving
documents! (do not press Cancle)

The virus contains the comments:
_____ ___ ____ __ __ _ _____ _____ ____
| ___/ _ | _ | / | / |_ _| ____| _ | |_ | | | | |_) | |/| | / _ | | | _| | |_) |
| _|| |_| | _ <| | | |/ ___ | | | |___| _ <
|_| \___/|_| \_\_| |_/_/ \_\_| |_____|_| \_The Word Macro Virus by Formater '98

Check other viruses! Be aware! Use Antiviral Software

Hafen.781

Description Hafen.781

These are not dangerous nonmemory resident parasitic viruses. They search for .EXE files of the subdirectory tree, and write themselves to the end of the file.
"Hafen.1640,1641,1689" contain the decrypted body of "Ambulance" virus, and infect .COM files with this sample (drop the virus). "Hafen.809" decrypts and displays the message:
Hafenstraße bleibt !

"Hafen.781" decrypts and prints to the printer the message:
Kilroy was here - (C) 1991, VDV.

"Hafen.818" creates the files with the random names, these files contain the text:
Hafenstraße bleibt !

"Hafen.1191" manifests itself with a moving picture:

Haharin

Description Haharin

It is a very dangerous memory resident boot virus. It hooks INT 13h and writes itself to the MBR of the hard drives and boot sector of floppy disks. Depending on its counter the virus erases disk sectors and displays the message:
Haharin is not dead !

Home