Virus Database

Macro.Word.Kiffer

Description Macro.Word.Kiffer

This is German-specific Word macro virus. It contains six macros, some macros have random selected names:
Documents MICROSOFT.DOT (infected Word)
<random> dateispeichernunter
extrasmakro extrasmakro
dateischliexen <random>
dateidokvorlagen dateidokvorlagen
<random> <random>
autoopen <random>

It infects the system on opening and on closing an infected document. To affect Word the virus creates the infected MICROSOFT.DOT template in the Word startup path. Documents get infected when saved with a new name.
The infection-routine is placed in a macro with a random name. This macro is encrypted in documents and is decrypted in case of need. The names of macros (random names) are stored in documents' variables (in case of documents), in case of MICROSOFT.DOT file (infected system) they are stored in the WIN.INI file in the section [embedding] in the items vxdRNDM, TaskRNDM, SystemRNDM.
On the 30th of any month the virus displays the message:
Leeglize Cannabis !! R.M.M (C) by MaD KiFFeR 05.09.98

On the 15th the virus appends to the AUTOEXEC.BAT file the commands that cyclically display the text:
Infected with RnDm MuTanT MuTaGeN (c) MaD KiFFeR 05.09.98

The virus contains the comments:
***********************************
* WM RnDm MuTaNt MuTaGeN *
* vers Beta *
* Polymorphism/Stealth *
* encrypted by RMEG *
*Random Macro Encryption Generator*
* fools F/WIN32 1.13, F/WIN 4.38 *
* Winguard, F-PROT3/F-MacroW1.1 *
* etc.!! *
* only works with WORD95ger *
* F**k slow WordBasic *
* special Thanx to [SLAM] Mag *
* 05.09.98 /Germany *
* (c)by MaD KiFFer *
***********************************

Check other viruses! Be aware! Use Antiviral Software

LamersSuprise.1282

Description LamersSuprise.1282

It is not a dangerous nonmemory resident parasitic virus. It searches for EXE files and writes itself to the end of the file. It contains/displays the text string:
Lamers Suprise v1.00-
---Oh No!, All your files are as good as dead, Data files manipulated
(only slightly) and executables infected with a BIG FAT VIRUS.--YOU
FUCKING LAMER--

Lamour.2461

Description Lamour.2461

It is a very dangerous memory resident parasitic polymorphic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed, opened or accessed with FindFirst/Next DOS calls (both FCB and ASCII formats).
The virus has bugs and may halt the system while installing or while infecting files. On September 19th it erases the hard drive sectors. It contains the text string:
L'AMOUR v2.0 designed by NTUBL (National
Taiwan University Bacteriophage Lab)

Home