Macro.Word.Naen
Description Macro.Word.Naen
This is an encrypted virus that contains four macros: OemLogo, FileTemplates, AutoOpen (MeoClose in NORMAL.DOT), OemClose (AutoClose in NORMAL.DOT).
The virus infects the global area on AutoOpen and writes itself to the documents on AutoClose. On entering File/Templates menu the virus displays the MessageBox:
Microsoft Windoze
Windoze Frotection Error
The virus creates the C:WINDOWSSYSTEMOEMINFO.INI file and writes the text to there:
[general]
Manufacturer=NAENBGOURSG
Model=209711 - SO.HT.AI.KS
The virus then creates the C:WINDOWSSYSTEMOEML.NIK file and writes to there a hexadecimal dump of OEMLOGO.BMP, then creates the C:WINDOWSSYSTEMOEMZ.BAT file and writes to there commands that convert this hexadecimal dump to BMP file:
@echo off
debug < oeml.nik > nul
del oeml.nik
del oemz.bat
The resulting BMP file contains a logo with text:
CREATED BY NAENBGOURSG
The virus also contains commented text strings:
by NAENBGOURSG
SO.HT.AI.KS
231076-GREECE
VRD 19-4-1997
------------------------------
+ · ÷ x
x x
·
·
--------------------------------
Latin word -virus- means poison and is a derivative
of two Sanskritic roots --> -vishas->(poison)
and -ishus->(arrow).
NAENBGOURSG - SO.HT.AI.KS
M.SC. in MacroViral Science
---------------------------------
Check other viruses! Be aware! Use Antiviral Software
Marzia.Demian.1536
Description Marzia.Demian.1536
This is a harmless virus. It writes itself at the end of EXE-files are executed or opened. It contains the internal text strings:
(c)92 ASTRATTOSPAZIO realtà del mondo extraterrestre: Globalmente si
distingue tutto ciò che è uguale,localmente tutto ciò che è diverso.IT
Release Rev 4 24IX89 P.098 :) bye bye SPECIAL THANKS TO MAXCC, ALEX & DEMO.
DVDEMIAN
Marzia.Minosse
Description Marzia.Minosse
It is a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed or opened. It contains the text string:
Minosse
Depending on the system time it erases the disk sectors.
|