Virus Database

Macro.Word.Inside

Description Macro.Word.Inside

This virus contains one macro "autoOpen" in infected documents and two macros "AutoOpen" and "Disaster" in global macro area. It infects the global macro area (NORMAL.DOT) on opening an infected document and writes its code to documents that are opened.
In documents the virus keeps the infection routine in area of document's variables. While infecting NORMAL.DOT the virus ("AutoOpen" macro) creates the temporary file DISASTER.DEC, copies the document's variables to there and opens it. Newly created document contains a macro that infects the NORMAL.DOT.
While infecting a document the virus creates the same file DISASTER.DEC, writes its code to there and inserts this document into document's variables. Then the virus copies the "AutoOpen" macro to this document.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Formater

Description Macro.Word.Formater

The virus contains five macros: AutoExec, AutoOpen, DLLError, ToolsMacro, ToolsCustomize. It replicates on opening documents.
In the WIN.INI file in the [Formater] section in the Activated string the virus keeps the counter that is increased on each loading Word with infected NORMAL.DOT.
On starting Word on August 20 the virus creates a new document and runs the text there:
Word Macro Virus Formater!!! by Formater . This is my birthday!
I'm <1998 minus current year number> years old! Don't try to find meall

On entering the Tools/Macro or Tools/Customize menu the virus displays the MessageBox:
Formater
Cannot find FORMATER.DLL. Windows
needs this file to run winword.exe

On entering the same menus on August 20 the virus displays the InputBox and waits for "Formater" input, otherwise it exits the Windows:
Formater
I'm a Word Macro Virus! I said: 'Don't try to find me!!!' You didn't
listen to me! Enter my name, or I will quit from Word without saving
documents! (do not press Cancle)

The virus contains the comments:
_____ ___ ____ __ __ _ _____ _____ ____
| ___/ _ | _ | / | / |_ _| ____| _ | |_ | | | | |_) | |/| | / _ | | | _| | |_) |
| _|| |_| | _ <| | | |/ ___ | | | |___| _ <
|_| \___/|_| \_\_| |_/_/ \_\_| |_____|_| \_The Word Macro Virus by Formater '98

Macro.Word.Four

Description Macro.Word.Four

This virus contains one macros in document AutoOpen, and four macros in NORMAL.DOT: AutoClose, FileTemplates, NoMercy, ToolsMacro.
It infects the global macro area on opening an infected document (AutoOpen), and infects documents that are closed (AutoClose). In some cases it sets on documents a password consisting the current time.
The virus creates the AutoClose, FileTemplates, ToolsMacro macros in NORMAL.DOT by entering lines of text (line by line). At the beginning of each macro there is the comment:
/----------------------------------------------------------| Virus name: 4in1 (Four in One) |
| Origin : Indonesia, Yogyakarta |
| Author : Foxz [NoMercy] July 97 |
| URL&eMail : You Know it !! :) |
----------------------------------------------------------/

Home