Virus Database

Macro.Word.Pelo

Description Macro.Word.Pelo

This virus contains five encrypted macros:
Documents NORMAL.DOT
in in
autoclose close
a autoclose
i arquivoimprimir
ip arquivoimprimirpadrão

The virus infects the document and global macros area on closing files. On printing it appends to the end of current document the string:
VOCÊ FOI INFECTADO PELO VÍRUS VALADARES!

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Ozwer

Description Macro.Word97.Ozwer

This is a stealth macro virus. It infects global macros area (NORMAL.DOT template) on opening an infected document and hooks many events: documents open, close, save, print, paste and copy commands, etc. Other documents get infection on any of hooked actions. While infecting a document the virus changes MS Word window caption to "ø Microsoft Word".
To hide itself the virus disables menus:
Tools/Macro
Tools/Templates and Add-ins..
Tools/Customizeall
Tools/Options...
View/Toolbars

It also displays own ToolMacro dialog box where are no any macro listed. On try to open Visual Basic Editor the virus displays one of two messages (depending on MS Word localisation):
Error interno en Word Basic Err=1100e.
Imposible cargar bibliotecas din¡micas.
Compruebe que todos los archivos estŠn
en sus carpetas.
Si el problema persiste, consulte la guia
del usuario.
Word Basic internal error Err=1100e
Unable to load module 1x6004.
Check that all files are in their folders
and that they are not damaged.
If the problem persists, consult user's guide.

Every twenty minutes the virus checks words count in current document and if it is in ranges 350-400, 700-750, 900-950, 1000-1050, 1150-1200, 1300-1350 or 1500-1600 then in one case of four the virus mixes words in the document.

Macro.Word97.PaixVirus

Description Macro.Word97.PaixVirus

This virus contains seven macros in one module "PaixVirus97": AutoExec, AutoOpen, FileSaveAs, FileTemplates, PayLoad, ToolsMacro, ViewVBCode.
It infecting global macros area at opening an infected document and infects documents on saving them with new name.
After infecting NORMAL.DOT the virus displays the MessageBox:
PaixVirus97
La PAIX soit avec vousall
HAHA !!!!

On random selected days it displays the MessageBox:
PaixVirus97
C'est le jour J pour moi...

It then scrolls in the StatusBar the string:
Je veux avoir la paix!!!!!, merci

Home