Virus Database

Macro.Word.Innocence.a

Description Macro.Word.Innocence.a

This is an encrypted German specific Word macro virus. It contains 11 macros: AutoOpen, DateiOffnen, DateiSpeichern, DateiSpeichernUnter, FileOpen, FileSave, FileSaveAs, HilfeInfo, InnLib, Innocence, ToolsMacro. The complete set of virus routines is places in the InnLib macro. Other macros just call necessary routines from this macro.
The virus infects the global macros area (NORMAL.DOT) on opening an infected document. The virus also creates in Word StartUp directory the infected file named INLAY.DOT. Documents get infection on saving and saving with new name. Its presence virus detects by document's variable "Innocence", in infected documents it is equal to "Robert".
On opening any document the virus checks the presence of other viruses. In case of detection the virus displays the MessageBox in German and then MessageBox to request the virus disinfection. In case positive answer new virus is removed, and into the WIN.INI file in the field [Sense] the following strings are appended:
Killed= < the count of desinfection viruses >
WhichWasIt= < the name of virus >

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Messa

Description Macro.Word.Messa

This is an encrypted macro virus. It contains 21 macros: CUS, EOP, ESA, NIZ, PLT, WEV, CROM, CUST, ESAA, INFO, MESSA, WATCH, BEEPER, README, AutoExec, AutoOpen, FileOpen, FileSave, FileSaveAs, TheVWarning, POO.
The virus infects the system on opening an infected document - it copies this document with new name THEVWARN.ING to Word Startup-Path and User-Dot-Path. As a result the virus will activate each time Word will start (Word reads and loads templates from Startup-Path and User-Dot-Path). The virus also infects the global macro area. The documents get infection on opening and closing.
Depending on the current time the virus hooks timer and sets on timer the BEEPER macro. It also runs the OOP macro (it is renamed POO) that on pressing Alt-Ctrl-Shift-K is runs the TheVWarning macro. TheVWarning macro in one minute runs the WATCH macro. The WATCH macro renames the macros:
OEX - AutoExec
OOP1 - AutoOpen
EOP - FileOpen
ESA - FileSave
ESAA - FileSaveAs
NIZ - Organizer
CROM - ToolsMacro
PLT - FileTemplates
CUS - ToolsCustomize
CUST - ToolsCustomizeToolbar
WEV - ViewToolbars

The BEEPER macro beeps and displays the MessageBox:
I am so sorry. I do not mine it to disturb You.
But maybe all there is something that You have to do! <Time>
THE 'V' WARNING <Date>

The MESSA macry displays the message:
THE 'V' WARNING MESSAGE
Sorry to interrupt You. I think You are tired,
because You have worked until midnight.
so I suggest You to go to bed now and
tomorrow You could work harder than this day.
Kota Pelajar, Yogyakarta.

Macro.Word.Messenger

Description Macro.Word.Messenger

This is not a dangerous encrypted German-specific macro virus. The infected documents contain three original virus macros: AutoOpen, virenlist1 and virenlist2, that are copied to 11 macros while infecting global macros area: DateiSpeichern, DateiAllesSpeichern, AutoExec, AutoExit, AutoNew, AutoOpen, AutoClose, DateiSpeichernUnter, virenlist2, virenlist1, AutoOpen1.
The virus contains the comments:
MNAS (58332)
SSAS, ich liebe Dich!
Dein MNAS
Super Macro Botschaft für Deutschland

Depending on the system date the virus displays the MessageBoxes:
S.Nr.: 0516047684070397-3
Ich bin das 'Super Macro Botschaft für Deutschland'.
Ich habe KEINE Schadensfunktion, ich bin als Liebesbotschafter
und bin gegen RECHTS gedacht!BITTE last mich am leben.
Herzlichen Glückwunsch zum Geburstag SSaS!
Dein M.N.a.S.
P.S.: SSaS sei nicht sauer über die Botschaft!
P.P.S.: Ich liebe Dich!
Ich habe KEINE Schadensfunktion!!!
An Alle:
Ich bin nur als Liebesbotschafter gedacht! BITTE last mich am leben
Das Schwein wurde geboren
Das Schwein Adolf Hitler wurde am 20.04.1889
in Braunau (Österreich) geboren
Das Schwein hat Selbstmord begannen
A. Hitler, die feige Sau, hat am 30.04.1945 in Berlin Selbstmord begannen,
er wollte sich der Strafe des Volkes etziehn
Kriegsbeginn (01.09.1939)
Zum gedenken an den 2. Weltkrieg. Mussten soviele Opfer sein!?
Kriegsende (08.05.1945)
Hitlers Vernichtungszüge wahren endlich zuende! Ich bitte um eine
Schweigeminute, um an die Opfer des 2. Weltkrieges zu gedenken.
An alle Lehrer
Jetzt sind die Lehregefragt. Nimmt mehr über Hitler und die Nazis durch,
damit Schüler wissen, was das für Schweine sind.
An Alle:
Ich habe KEINE Schadensfunktion!!!
Ich bin nur gegen RECHTS gedacht! Bitte last mich am leben!

Home