Virus Database

Macro.Word.Kompu

Description Macro.Word.Kompu

This macro virus contains two macros: AutoOpen and AutoClose. It infects global macros area on AutoOpen and writes itself to documents on AutoClose. On 6th and 8th of any month it display the InputBox with the message:
Tahan kommi!
Mul on paha tuju!

and waits for "komm" string. It then prints the string to the status line:
Nämm-Nämm-Nämm-Nämm-Amps-Amps-Klõmps-Kröök!

The virus also contains the commented string:
Makroviirus Kompu

Check other viruses! Be aware! Use Antiviral Software

Lehigh

Description Lehigh

This is a very dangerous memory resident parasitic virus. It hooks INT 21h and writes itself into the middle of COMMAND.COM when it is executed, or accessed with DOS function FindFirst (AH=4Eh).
The virus is located in COMMAND.COM stack area and does not increase the file length. The virus changes the 2nd and 3d bytes of the file (JMP Loc_Virus).
The body of the virus contains a counter that increments by 1 on every successful infection of next COMMAND.COM file. The counter is saved on disk only when infected COMMAND.COM has been run from the hard disk. Otherwise the counter state is zeroed on every reboot of DOS. When the counter reaches 4, the virus erases the first 32 logical sectors of the disk which it has been run from.

Lemena.3544

Description Lemena.3544

It is not a dangerous memory resident parasitic polymorphic virus. It copies itself to the video memory at address BC00:0000, hooks INT 22h (Terminate call), returns control to host program, waits for termination and hooks INT 21h. To hook INT 21h the virus patches the DOS kernel. The virus then writes itself to the end of COM and EXE files that are executed, opened or accessed by Get/Set File Attributes DOS call.
To hide itself in the system memory the virus uses a quite complex way. When any program is executed, the virus allocates a block of XMS memory, moves its code to there, then copies its INT 22h handler to DOS kernel (the virus looks for a cave in there). The virus then releases INT 21h, hooks INT 22h, erases its TSR copy in the video memory and releases control. As a result, when any program (including anti-viruses) are active, there are no virus code in the DOS memory. The main part of virus code (encrypted) is placed in the XMS memory, and INT 22h handler is "waiting" for the Terminate call to restore "status quo" (move virus code from XMS to the video memory and to re-hook INT 21h).
The virus also uses anti-debugging tricks as well as on-the-fly encryption: the virus decrypts its subroutines before calling them, and encrypts after return from subroutine.
The virus does not infect anti-virus programs -V.EXE, ADINF, AIDSTEST, AVP, CPAV, and so on according to the string (two letters per name):
-VADAIAVCPDRF-FIGUIMIVMSNAPCSCSPSSSVTBTOV-VAVSWE

The virus deletes the anti-virus databases: ANTI-VIR.DAT, AVP.CRC, CHKLIST.CPS, CHKLIST.MS, CHKLIST.TAV, CRC.SVS, FILES.VVL FINGERP.VVF IM.PRM IVB.INI, IVB.NTZ, MSAV.CHK, SMARTCHK.CPS, AV.CRC, BOOT.CPS, BOOT.MS, BOOT.NTZ, BOOT.TAV, IV.INI, PART.NTZ
According to its random counter the virus displays the texts:
LEMENA'97
BOKEPH'97

The virus also contains the text strings:
TBDRVXXX
[LEMENA'97] by Bokeph from Batavia, Indonesia
[MENA]

Home