Virus Database

Macro.Word.Illiteral

Description Macro.Word.Illiteral

This is an encrypted Word macro virus. It contains three macros in documents and four macros in NORMAL.DOT: AutoOpen, Nod(AutoClose), Tiberium(FileTemplates, ToolsMacro).
The virus infects the global macros area (NORMAL.DOT) on opening an infected document and writes itself to documents that are closed.
On Sundays as well as on entering the Tools/Macro menu the virus sets the password for documents that depends on the current time. The virus then displays the DialogBoxes:
Brotherhood of NOD
User error !!, replace User !!
Enter new user name here:
If User name not fill, your data will be delete !
Brotherhood of NOD
Okay
We need to restart Word First

Then the virus writes the text to the C:WINDOWSNOD.INI file:
/----------------------------------------------------------|Virus name: Brotherhood Of NOD |
|Origin : Indonesia, Yogyakarta |
|Author : Foxz NoMercy Members |
|URL : http://www.geocities.com/ResearchTriangle/3996 |
----------------------------------------------------------/
Dear <User>,all
You was distrub this virus! please dont doit again
Password For <filename> = <password>
I'm fair !!, I let you know the password for
Your document. Peace!! and Unity!!
--><--><--><--><--><--><--><--><--><--><--><--><--><--><--

Check other viruses! Be aware! Use Antiviral Software

Stoned.a

Description Stoned.a
"Stoned" family. At midnight, this virus displays the following message:
IT'S MID NIGH

Stoned.Military
In November, this virus tries to format hard drive sectors.
Stoned.Million
This virus does not save the original floppy Boot sector and types "Non-System disk" while booting from an infected floppy. It overwrites the OEM message of the floppy Boot sector with the string "1000000".
Stoned.Near.a,b
These are stealth viruses. With the probability of 1/16 they will erase the MBR and displays the text:
Near Dark

Stoned.Nichols
Sometimes this virus displays:
[Nichols] by Apache

Stoned.Nov7
In October, this virus types a face symbol (01h ASCII) while booting, and on November 7, it erases the MBR.
Stoned.PC-AT
This is an encrypted virus containing the non-encrypted text string:
PC AT

= "heart" symbol
Stoned.Rostov
While booting from an infected floppy disk, this virus has the probability of 1/32 of eraseing eight sectors on the hard disk.
Stoned.Satria
Stoned family. It displays a picture.
Stoned.Scale
"Stoned" family. It saves the Boot sector of floppies and the MBR hard drive at the address 0/0/9 (track/cylinder/sector). Sometimes it plays a tune (scale).
Stoned.Scrlock
These viruses disable writing to the hard drive if the ScrollLock key is pressed.
Stoned.Scroll
It scrolls the screen if NumLock is pressed and ScrollLock is released.
Stoned.Sex.a,b
These viruses infect disks while accessing them (INT 13h, AH=2,3). They save the original sectors (boot and MBR sectors) at the addressed 1/0/3 (head/track/sector) for a floppy disk and 0/0/8 (or 0/0/7 according to its version) for the hard disk. While loading from an infected floppy disk, the viruses, with the probability of 1/8, display the messages:
"Stoned.Sex.a": EXPORT OF SEX REVOLUTION ver. 1.1
"Stoned.Sex.b": EXPORT OF SEX REVOLUTION ver. 2.0

Stoned.Spook
While infecting the hard drive, this virus writes 8 sectors to 1--9 sectors of the hard drive, and as a result, it can erase the system information. It contains a texts:
Spook 1.0
LIM

Stoned.Swedish
This virus displays the message "The Swedish Disaster".
Stoned.Torm
While booting from an infected disk, this virus, with the probability of 1/8, displays:
Repent for ye shall be tormentedall
Tormentor B - RABID Int'nl Dev. Corp. '91

Stoned.TurboManiac
On October 19, it displays:
The Turbo Maniac was here..

Stoned.WXYC
It infects boot sectors of the floppy disks and first boot sector (not MBR) of the hard drive. It contains the strings:
JAM WXYC
WXYC rules this roost!

Sometimes it displays the latter string.
Stoned.YMP
On the 1st of every month, it displays the message "HAVE A NICE DAY (c)YMP".
Stoned.Zappa
On December 4, it erases the disk sectors and displays:
Dedicated to ZAPPA...

Stoned.Zapped
This virus erases the disk sectors and displays the message:
ZAPPED YOU!

StoneHeart.1490

Description StoneHeart.1490

It is a very dangerous memory resident polymorphic parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed, opened, or accessed by Get/Set File Attribute DOS call. The virus does not infect anti-viruses AIDSTEST, AVP, SCAN, WEB,all according to the string (three letters per name): "AIDAVPPROSCAEXTWEB". While infecting a file the virus also encrypts a block of file code/data, before return control to the host program the virus decrypts this block.
While installing memory resident the virus deletes files in root directories on all disks, a file is to be deleted only if seventh letter of its name is the same as disk letter - C:??????C?.*, D:??????D?.*, e.t.c.
The virus contains the text strings:
:*.*
StoneHeart II
EMME Small 1.1

Home