Virus Database

Macro.Word.Ochoy

Description Macro.Word.Ochoy

This is an encrypted macro virus containing five macros in infected documents and ten macros in global macros area (NORMAL.DOT):
Documents NORMAL.DOT
Ard01, AutoOpen Ard01
Ard02 Ard02, FileSave, AutoClose
Ard03 Ard03, FileTemplates, ToolsMacro, ToolsCustomize
Ard04 Ard04, FileOpen

It infects the global macros area on opening an infected document (AutoOpen) and copies itself to documents that are saved or closed (FileSave, AutoClose). Before infecting the virus deletes all macros in target. The virus stores the counter of infections in document's variable "ard01". Depending on this counter the virus either prints to the status line the text "O C H O Y * P K T B N I", or displays the MessageBox:
BNI - PKT
(c) Ardi Sunardi - 1 9 9 7

Check other viruses! Be aware! Use Antiviral Software

Tan family

Description Tan family

These are harmless memory resident parasitic viruses. They hook INT 21h and write themselves to the end of .COM files. The viruses infect only files that are archived to PKZip files - when .ZIP file is opened, the viruses start to intercept .COM files opening, infect them and disinfect on closing. As a result the files on disk are not infected, but in ZIP archives there are their infected copies.
The viruses do not manifest themselves in any way, they contain the text:
TANxxxxxxx

Tangle Family

Description Tangle Family

These are harmless nonmemory resident encrypted parasitic viruses. They search for .COM files, then write themselves to the end of the file. They use several anti-debugging tricks and quite tangle infection routine. They do not manifest themselves in any way.

Home