Virus Database

Macro.Word.NPad

Description Macro.Word.NPad

It is an encrypted virus. It contains only one macro AutoOpen and infects the global area / documents on opening an infected file / document.
The virus creates the profile section (WIN.INI file):
[NPad328]
Compatibility=

and saves its counter in there. On any infection the virus increases that counter. When the counter reaches 23, the virus moves the string at the status bar line:
D0EUNPAD94, v.2.21, (c) Maret 1996, Bandung, Indonesia

The virus also has commented strings:
D0EUNPAD94, v.2.21, (c) Maret 1996, Bandung, Indonesia
Macro MsWord virus, multiplatform, multi versi

Check other viruses! Be aware! Use Antiviral Software

Asmodeous Family

Description Asmodeous Family

These are dangerous memory resident encrypted parasitic viruses. They hook INT 21h and write themselves into the middle of COM and EXE files that are executed or opened.
The viruses are divided into 10 blocks of code. While infection the viruses rearrange these blocks in randomly selected order (see "Badboy" viruses).
On November 11th these viruses delete the files when FindFirst/Next (AH=4Eh,4Fh) DOS calls are performed.
The viruses contain the internal text strings:
"Asmodeous.1160": ASMODEOUS
"Asmodeous.1343,1829,1833": Asmodeous
"Asmodeous.1437,1450": Asmodeous 9C

AsmVir Family

Description AsmVir Family

These viruses search for .ASM files and overwrite them with virus' hexadecimal dump. While overwriting the viruses add to this dump the assembler instructions that allow to compile and link infected .ASM files:
;~ <- virus ID
casmseg segment
assume cs:casmseg,ds:casmseg,ss:casmseg
org 100h
.radix 10
start:
db all <- virus hex dump
db ...
casmseg ends
end start

Being compiled and linked infected .ASM files can spread the virus.
The viruses also contain the text:
ASMVirus by Qark/VLAD042

Home