Virus Database

Macro.Word.Inlay

Description Macro.Word.Inlay

This is a German-specific Word macro virus. It contains eleven macros: InnLib, FileOpen, FileSave, HilfeInfo, Innocence(AutoOpen), FileSaveAs, ToolsMacro, DateiOffnen, DateiSpeichern, DateiSpeichernUnter, ExtrasMakro.
All infection routines are placed in InnLib macro, all other macros call InnLib for necessary routines.
On opening a document the virus checks it for the macro viruses:
Atom Boom:De Buero:De Cap:De Clock:De Colors Concept Darkside Friday:De
Gangsterz Hot Imposter Lazy NF NomVir:De Friends:De Nuclear Nop:De Pheew
Spooky:De Stryx Target Tele Wazzu Zero:De Xenixos:De Outlaw

If any virus is found, the "Inlay" virus displays the MessageBox:
Innocence meldet:
Die Datei <FileName> enth lt einen Makrovirus .
Identifiziert als: <VirName>
KEINE PANIK:
Innocence wird nun versuchen, diesen Virus zu entfernen.
Ihr Dokument wird nicht besch digt.

The "Inlay" virus calculates the number of detected viruses in the WIN.INI file in the section "[Intl]" in string "Killed". In string " "Inlay" it keeps the month of latest infection. The virus also creates the INLAY file which adds to the NORMAL.DOT and registers in the "pfad" string.
On entering the Tools/Macro menu the virus saves "backup" of the current document to the NORMAL.DOC, removes all its macros and loads original not infected file

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Crud

Description Macro.Word97.Crud

This is a stealth macro virus. It contains six macros: AutoOpen, AutoClose, ToolsMacro, FileSaveAs, ToolsProofing.
The virus replicates itself on opening, closing and saving documents. It also disables VirusProtection. On entering Tools/Macro menu it displays the Balloon:
Help !!
That option is not installed, please install the HELP files to continue

Macro.Word97.Cryptor

Description Macro.Word97.Cryptor

This virus contains six macros in module "CryptorV97": AutoOpen, AutoClose, FileSaveAs, FileTemplates, ToolsMacro, ViewVBCode. It infects the global macro area on opening an infected document and infects documents on saving with new name.
The virus disables Word virus protection. On odd days the virus encrypts the document contents. After infecting NORMAL.DOT or a document it displays corresponding MessageBox:
Virus CryptorV97 Virus CryptorV97
Attention, modèle normal crypté ???? ZeMacroKiller98 vous remercieall
On entering the menu items "Tools/Templates and Add-Ins...", "Tools/Macro" and "Tools/Macro/Visual Basic Editor" the virus displays corresponding MessageBox:
Microsoft Word
Espace pile insuffisant.
Microsoft Word
Fonction Sub non défini
Microsoft Word
Ce programme a réalisé une opération illégale et va être interrompu.

Home