Virus Database

Macro.Word.Messa

Description Macro.Word.Messa

This is an encrypted macro virus. It contains 21 macros: CUS, EOP, ESA, NIZ, PLT, WEV, CROM, CUST, ESAA, INFO, MESSA, WATCH, BEEPER, README, AutoExec, AutoOpen, FileOpen, FileSave, FileSaveAs, TheVWarning, POO.
The virus infects the system on opening an infected document - it copies this document with new name THEVWARN.ING to Word Startup-Path and User-Dot-Path. As a result the virus will activate each time Word will start (Word reads and loads templates from Startup-Path and User-Dot-Path). The virus also infects the global macro area. The documents get infection on opening and closing.
Depending on the current time the virus hooks timer and sets on timer the BEEPER macro. It also runs the OOP macro (it is renamed POO) that on pressing Alt-Ctrl-Shift-K is runs the TheVWarning macro. TheVWarning macro in one minute runs the WATCH macro. The WATCH macro renames the macros:
OEX - AutoExec
OOP1 - AutoOpen
EOP - FileOpen
ESA - FileSave
ESAA - FileSaveAs
NIZ - Organizer
CROM - ToolsMacro
PLT - FileTemplates
CUS - ToolsCustomize
CUST - ToolsCustomizeToolbar
WEV - ViewToolbars

The BEEPER macro beeps and displays the MessageBox:
I am so sorry. I do not mine it to disturb You.
But maybe all there is something that You have to do! <Time>
THE 'V' WARNING <Date>

The MESSA macry displays the message:
THE 'V' WARNING MESSAGE
Sorry to interrupt You. I think You are tired,
because You have worked until midnight.
so I suggest You to go to bed now and
tomorrow You could work harder than this day.
Kota Pelajar, Yogyakarta.

Check other viruses! Be aware! Use Antiviral Software

Slovakia.1629

Description Slovakia.1629

This a harmless non memory-resident encrypted parasitic virus. It searches for EXE files, then writes itself to the end of the file. After infection it may display the messages:
Greeting from Bratislava, SLOVAKIA.
Type the word SLOVAKIA :
SLOVAKIA virus version 2.00 (c) 1991 by ??. All Rights Reserved.
Then they wait for 'SLOVAKIA' input. On input error they display:
Type word SLOVAKIA, not CZECH, YUGOSLAVIA or SLOVENIA !! Press Esc.

Slovakia.2387

Description Slovakia.2387

This a harmless non memory-resident encrypted parasitic virus. It searches for EXE files, then writes itself to the end of the file. After infection it may display the messages:
Greeting from Bratislava, SLOVAKIA.
Type the word SLOVAKIA :
SLOVAKIA virus version 2.00 (c) 1991 by ??. All Rights Reserved.
Then they wait for 'SLOVAKIA' input. On input error they display:
Type word SLOVAKIA, not CZECH, YUGOSLAVIA or SLOVENIA !! Press Esc.
It also contains the text string:
Msg #0 to Slon! & Kuko. Hi _, pleased to meet your program. Enjoy new
version of S. :-) Bye ??

Home