Virus Database

Macro.Word.GreenFury

Description Macro.Word.GreenFury

This is a very dangerous Word macro virus. It does replicate only under the Italian Word version. The virus contains three original macros, but while infecting it copies them to four macros with the names:
NORMAL.DOT Infected files
Macro1 GreenFury GreenFury
Macro2 FileSalvaConNome GGGFFF
GGGFFF
Macro3 FFFGGG FFFGGG
AutoOpen

The virus infects the global macros area on AutoOpen and writes itself to files on FileSalvaConNome (FileSaveAs).
Under non-Italian Word the virus erases all files in current directory. Depending on the system random counter the virus sets the random selected password for current document.

Check other viruses! Be aware! Use Antiviral Software

Caesar

Description Caesar

This is a harmless, non-memory resident encrypted parasitic DOS virus. It infects DOS EXE files and creates its "dropper" in the C:WINDOWS directory.
When an infected file is run, the virus creates the infected CAESAR.EXE file (virus dropper) in the C:WINDOWS directory and overwrites the WINSTART.BAT file with an instruction that will run the virus dropper. As a result, virus dropper is activated each time Windows is started up. The virus then returns control to the host program and does not infect any other files.
When the virus dropper takes control, it searches for *.EXE files on all drives and infects them. While infecting, it writes itself to the end of the file. The virus checks file names and avoids infecting the following files:
AN*, AD*, DR*, PR*, NC*, WI*
Because of its method of infection, the virus is functional only when Windows is installed exactly in the C:WINDOWS directory.

Cagliari family

Description Cagliari family

These are very dangerous memory resident parasitic viruses. They hook INT 21h and write themselves to the end of .COM files that are executed. On May 1st they erase the FAT sectors on disks A, B, C, D and then display the message:
caGLiArI

The similar string is used by virus in its "Are you here?" call - while installing the virus calls INT 21h with AX=FFABh, the memory resident copy returns 'CA', 'GL', 'IA', 'RI' in registers AX,BX,CX,DX.

Home