Macro.Word.Greenpeace
Description Macro.Word.Greenpeace
It is an encrypted Word macro virus, it contains seven macros:
Documents NORMAL.DOT
FlSvvs FileSaveAs
FlSvv FileSave
AtExc AutoExec
FlOpvvv FileOpen
AutoOpen ImpRovevvvv5
TlsMcr ToolsMacro
FileExit FClccc
The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are saved with new name (FileSaveAs).
On 22 May 1998 when Word is starting, the virus displays the MessageBox:
Belik Natasha demands:
Stop pollution of an environment!!!!!
Protect ozonian layer!!!
Rescue Volga!!!
Pay the salary!!!!!
GreenPeace Virus
If the author of document is "Igor Daniloff", the virus replaces the AutoOpen and IDRWEBSCAN macros with harmless ones: new AutoOpen displays the MessageBox:
In the WinWord6.0/7.0rus environment
the viruses are not distributed
DrWeb for WinWord
IDRWEBSCAN is replaced with do-nothing macro.
On entering the "Tools/Macro" menu the virus sets the document password protection (password="orhey"), and resets it after leaving "Tools/Macro".
Check other viruses! Be aware! Use Antiviral Software
Nazgul Family
Description Nazgul Family
These are harmless nonmemory resident parasitic viruses. They search for .COM files, then write themselves to the beginning of the file. The viruses contain the texts:
"Nazgul.209": *.COM
"Nazgul.266": *.COM Nazgûl
Nazgul_II.2366
Description Nazgul_II.2366
It is a very dangerous memory resident parasitic polymorphic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. It has several errors and other corrupts files while infecting them and halt the system. It contains the text string:
[Nazgul]
|