Macro.Word.Junk.a
Description Macro.Word.Junk.a
These are stealth and polymorphic Word macro viruses. They contain two macros in infected documents (AutoClose, NoMercy) and three macros in the NORMAL.DOT (AutoClose, ToolsMacro, FileTemplates).
On closing an infected document (AutoClose) they infect the global macros area (NORMAL.DOT), while infecting they copy the NoMecry macro to macros ToolsMacro and FileTemplates. The documents get infected also on closing. While infecting the virus changes the code of AutoClose macro (polymorphism) - the virus replaces the strings within that macro with other strings.
On 11th of any month the viruses display the MessageBoxes:
"Junk.a":
WELCOME AGAIN!
Hi you!! my name is Junkies! (c)NoMercy 1997
"Junk.b,c":
(c)NoMercy
The Junkies was back!
Check other viruses! Be aware! Use Antiviral Software
Hail.673
Description Hail.673
This is a harmless memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of COM files that are executed. On April 5th, the virus displays the following message:
We say retribution
We say vengance is bliss
We say revolution
With a cast iron fist
Hail and Kill 98
Hal
Description Hal
It is not a dangerous memory resident boot virus. It hook INT 13 and infects boot sector of floppy disks and the MBR of the hard drive. In some cases it displays the text:
HAL 3001
|