Macro.Word.Lunch
Description Macro.Word.Lunch
These viruses contain three macros, two original and one copy:
NORMAL.DOT Infected files
Macro1 FileSave NEWFS
NEWFS
Macro2 NEWAO AutoOpen
NEWAO
The viruses infect the system on AutoOpen and write themselves to files on FileSave. At 12:01 they display message box:
Lunch Time!
Whatya doin' here? Take a lunch break!
Check other viruses! Be aware! Use Antiviral Software
Pusher.374
Description Pusher.374
It is a harmless memory resident parasitic polymorphic virus. It hooks INT 21h and writes itself to the end of COM files that are executed. The virus contains the text strings:
[PUSH]
The most interesting feature of this virus is its polymorphic engine. Before writing to the file the original virus code (374 bytes) is converted to the polymorphic sequence of instructions that put this code to the stack segment (as a result each word of virus code is converted to several bytes, and file length grows by about 740 bytes). When complete virus code is put to the stack, the virus jumps to it:
MOV AX,Opcode1
PUSH AX
ADD AX,Data1 ; result is Opcode2
PUSH AX
SUB AX,Data2 ; result is Opcode3
PUSH AX
INC AX ; result is Opcode4
PUSH AX
all
JMP SP
The installation routine, when it takes control, copies the virus code to the system memory and returns to the host program.
Put.1939
Description Put.1939
It is not a dangerous nonmemory resident encrypted parasitic virus. It searches for .EXE files and writes itself to the end of the file. The beginning of virus the body contains the word "PUT". Sometimes the virus displays the message:
+--------------------------------------------------------------+
¦ Serdeczne gratulacje infekcji ¦
¦Prosze sie nie obawiac , ten wirus jest nie grozny dla systemu¦
¦Sluzy on badaniom socjologicznym mozliwosci rozprzestrzeniania¦
¦sie wirusa VIR v1.0. W celu uzyskania programu antywirusowego ¦
¦nalezy sie zglosic do Krzysztofa Trzesickiego w godzinach ¦
¦wieczornych. ¦
¦ Don`t be too angry for that. ¦
+--------------------------------------------------------------+
A teraz maly test all Hi,hi. Piotr Panek Corp 1992 version v1.4
Ile to jest ### razy ###
|
Home
Viruses from A to Z
0-9
A
B
Ñ
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Z
Mikael Forss Kommanditbolag
S Ö Byggkonsult
VADSTORPS BYGG AKTIEBOLAG
StÄd Och Golvteknik I GÖteborg Ab
Salinas StÄd Service
|