Virus Database

Macro.Word.Goldsec

Description Macro.Word.Goldsec

This is an encrypted Word macro virus. It contains three macros: AutoOpen, VisuaLand, FileSaveAs. The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are saved with new name (FileSaveAs).
The virus contains lots of comments and text dialog box. When run, the virus displays the MessageBox:
The Full Powered by VisuLand Technology
----------------------------------------------------------------
Virus: VisuaLand.WinWord
Author: Milky Wahyudi Widjaya
VRating: Make First WordMacro.virii (Concept)
Compiler: WordMacro in ToolsMacro
(C) 1983-1994 Microsft Corporation
Copyright: (C) 1997 VisuaLand Technolgy
Utilities: VLWVG - VisuaLand Word Virus Generator 1.00
Created by Milky Wahyudi Widjaya (PresDir VL
Last Update: 01-01-1997
VL Office: Visualand Technology (VISUALAND-DOM)
Jl. H. Marzuki No.37, RT 06/03
Jakarta, 11530
Indonesia
Dedication: - McNamara (Concept was created by you???)
- Eko Sulistiono (MD)
- All VirMarker in the World
Thank's: God
-----------------------------------------------------------------

The virus adds the item "About VisuaLand Technology GoldSecretall" to the "Help" menu, on entering the virus displays:
About VisuaLand Technology...
OK, Concept was updated, please look VisuaLand.Winword. I hope
you easy study again, because VisuaLand is the best virii in 1997. If you
have have any comment, please email to me: visualand@visualand.com,
bye... VisuaLand Technology CyberWorld WebSite in
http://www.visualand.com Welcome to VisuaLand Technology GoldSecret
îisuaLand Technology is a member in Internet, about research && creator
irii. We are the first creator virii (Document MS-Word). Concept virii,
is the my research. Concept is not wild, but Concept only for tutorial,
how to create some virii in Microsoft Word. It's illegal to use baby...
Some people said that first WordMacro virus was created by McNamara,
but it's bullshit. Concept was created by Milky Wahyudi Widjaya (PresDir
of VisuaLand Technology). from Jakarta - Indonesia. It's my GoldSecret!
Milky Wahyudi Widjaya - VisuaLand

Check other viruses! Be aware! Use Antiviral Software

Dith.1502

Description Dith.1502

It is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed. The virus does not manifest itself, it contains the text string:
AL-DITH FOREVER

Div.725

Description Div.725

It is a harmless nonmemory resident encrypted parasitic virus. It uses anti-debugging tricks. When an infected file is executed, the virus searches for COM files, then writes itself into middle of the file. It then leaves its copy in the system memory, hooks INT 21h and intercepts file accessing calls, but does not infect files. It seems that virus author did not complete this part of the virus code, so the virus is marked as "nonmemory resident".
The virus splits its code into four blocks (the second block is encrypted) and writes them to file at fixed offsets: 0, 100h, 300h, and to the end of the file. Beforehand the virus saves all erasing data to the end of the file.

Home