Virus Database

Macro.Word.Gsis.b

Description Macro.Word.Gsis.b

This encrypted macro virus contains four original macros that are copied with names:
Documents NORMAL.DOT
AutoClose AutoClose
AutoOpen AutoOpen
GNull Biblioteca, ArquivoModelos, FerramMacro
(or UtilMacro depend on version Word).
GArqImprimir ArquivoImprimir, ArquivoImprimirPadr o

It replicates itself on documents opening and closing (AutoOpen, AutoClose). To load its copy to the Word global macro area it writes its copy to the Word Startup directory with the GSIS.DOT name.
Starting from October 12 1997, if current document contains seven or more pages of text, the virus creates new document and writes the text to there:
GSIS will not survive !!
Natural & Gnomo are back !!
If you are not understanding anything that's happening here, call the closest GSIS *technician*.
Maybe he has another nice *solution* for your problem. Ha! Ha! Ha!
Things will be the way we want, from now on!
Natural, Inc. & Gnomo Produ es

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.DarkSide

Description Macro.Word.DarkSide

This is not a dangerous encrypted Word macro virus. It is related to the "MDMA" virus. It contains four macros: AutoClose, DarkSide1, HerramMacro, ToolsMacro. It infects the documents and the global macros area on AutoClose call.
The virus disables Tools/Macro menu (Herram/Macro in Spanish). It creates on disks the DARKSIDE.1 files and writes the texts to there:
ATENCION: esta computadora ha sido infectada!. DarkSide1 sin una
computadora es como Billy The Kid sin un revolver! ! . . . Virus DarkSide1
creado en la ciudad de Lima en enero de 1997 -=] DarkSide1 Is a peruvian
virus writer [=-

The virus also contains the REMarked comments:
DarkSide1 is in the wild!!! :-)
DarkSide1's E-Mail: virology@usa.net
DarkSide1's live in Peru!!

Macro.Word.DarkSide.b
This encrypted virus contains three macros: AutoClose, DarkSide1B, HerramMacro. It creates the DARKSIDE.NEW file in current directory on C: drive and writes the text to there:
DarkSide1 is Back!!
The name of this macrovirus is DarkSide1.B
Caro's name Dark.A ?! Caro Sucks!! :)
And rememberall DarkSide1 whitout a computer is like...
Billy the Kid without a gun!! :)
WM.DarkSide1.B] by DarkSide1 in Lima Peru 1997

The HerramMacro macro contain the texts:
it's only a clean macro :) very easy !!
DarkSide1 is Cool Macro Virus Writer :)
I like the macrovirii scene...rocks!! :)

Macro.Word.Date

Description Macro.Word.Date

This macro virus was written in Italy. It contains the automatic macro AutoOpen, by which it infects documents and the NORMAL.DOT template. The macro AutoOpen is encrypted (i.e. it is not directly modifiable). Besides the Main subroutine - inside macros it is present on default - the virus contains two other subroutines:
Infezione (Infection)
Effetti (Payload)

Before running the "Infezione" and "Effetti" subroutines, Word.Macro.Date checks the system date. If the year is < 1997 and month is < 6, the virus runs the infection routines, otherwise it aborts its operations.
Word.Macro.Date seems to work correctly also on the English version of Word.
The "Effetti" routine tries to delete the macro AutoClose from templates (disinfects "Divina" macro virus?).

Home