Macro.Word.Nostradamus
Description Macro.Word.Nostradamus
This Italian Word macro virus contains three macros: MacroOnFile, StrumMacro, AutoOpen. The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are saved (MacroOnFile - in NORMAL.DOT this macro has the name FileSalva).
This is the stealth virus - it draws its own Dialog (in Italian) on entering Tools/Macro menu.
On 31st the virus displays the MessageBox:
NOSTRADAMUS Virus
Barbaro impero dal terzo sarai soggiogato,
Gran parte d'individui della sua origine far perire:
Per decesso senile avverr la sua fine, il quarto colpir
Per timore che il sangue con il sangue morte ne derivi.
Centuria 3., LIX
Check other viruses! Be aware! Use Antiviral Software
EE
Description EE
It's a not dangerous memory resident virus. On loading from infected floppy it infects MBR of hard drive, then it hooks INT 1Ch, waits for DOS loading, then hooks INT 21h and infects floppies on DOS functions SELECT DISK and KEYBOARD INPUT calls (INT 21h, ah=0Eh,0Ah). Depending on current time it displays the 'î' character (ASCII EEh).
Egg.833
Description Egg.833
These are memory resident harmless parasitic viruses. They hook INT 21h and infect .COM- and .EXE-files on accessing them. They hook INT 6Ch also and use that vector as "I'm here" function when they install the TSR copy. They contain the internal text string also:
"Egg.833": egg
"Egg.1000": [EGG]-1000 xxxxxxxyyyyyyyzzzzzzz eat cry sleep pizza cash
getbackjack'chickens are good.ribbitribbitmefrogufrogwefrogs
|