Virus Database

Macro.Word.Kerranga

Description Macro.Word.Kerranga

This is a very dangerous virus. It contains five macros: Autoexec, FileSaveAs, FileOpen, FilePrintDefault, ToolsMacro.
On Autoexec the virus disables Word virus protection, if it presents in the Tools/Options/General menu, as well as prompt on NORMAL.DOT saving. On FileOpen and FileSaveAs the virus runs its infection routine. On ToolsMacro the virus opens 65 new documents, but does not execute original Tools/Macro menu. On FilePrintDefault on 18:00 the virus appends to the end of document the text:
Kerbaffely Urgo Kerranga! Kerranga!!!!

Then it deletes all *.DOC files in the current directory.

Check other viruses! Be aware! Use Antiviral Software

Pepper Family

Description Pepper Family

These are not dangerous nonmemory resident parasitic viruses. They search for .COM files and write themselves to the end of the file. Depending on the system timer they set the system date to previous day number and display:
"Pepper.529": GOL Strikes again!
"Pepper.529": yesterday once more

They also contain the text strings:
*.COM [pepper]

Perfume Family

Description Perfume Family

These are very dangerous memory resident parasitic viruses. They write themselves to the end of the .COM files. Being executed these viruses infect the COMMAND.COM file, then they hook INT 21h, stay memory resident, and then they infect the files that are executed. While installing into the memory they do not fix MCB list, that may halt PC.
Sometimes they erase the random sectors on the floppy disk. On the 80th attempt to infect already infected file the virus runs a dialogue, it displays:
Bitte gebe den G-Virus Code ein :

and waits for "4711" input. If this string is entered, the virus displays:
Tut mir Leid !

"Perfume.731" also contains the text:
G-VIRUS V1.3

"Perfume.731.b" contains/displays the texts:
IRA Virus 18
Irish Republican Army v18 Virus :
hat
By Capt Picard

Home