Virus Database

Macro.Word.Prizm

Description Macro.Word.Prizm

This is an encrypted Word macro-virus. It contains nine macros: PRiZM, AutoExec, AutoOpen, FileOpen, FileSave, FilePrint, FileSaveAs, ToolsMacro, and FileTemplates.
It is based on the "Word.Cap" virus, has a similar structure and instructions set. It replicates upon document opening, closing, and saving.
While printing, the virus appends a string to the end of the document that is printed:
Battle of life. Capital!!!

The virus has an unusual method of infection. While infecting, the virus performs several steps, uses the system registry, and drops an additional EXE file. The infection routine is placed in the virus' code as a set of text strings that are DDE (Dynamic Data Exchange) instructions. If needed, the virus executes them, and these instructions copy the virus' code to target the documents and templates.
To execute its DDE instructions, the virus saves them to the system registry in the "HKEY_CLASSES_ROOT###fileshellopenddeexec". The virus then registers a new extension "###", and sets DDEEXEC as a handler of files with such an extension.
The virus then creates a randomly named EXE file in the Windows temporary directory, and writes a short program into it. This program only creates and opens the "PRiZM.###" file. This file-name extension is linked with DDEEXEC, and as a result, Windows activates the virus, DDE instructions, executes them and they copy the virus code to a victim file.

Check other viruses! Be aware! Use Antiviral Software

A2Space.1315

Description A2Space.1315

This is not dangerous memory resident parasitic virus. While installing into the system memory it infects the C:COMMAND.COM and COMMAND.COM files. Then it hooks INT 17h, 21h and writes itself to the end of COM and EXE files that are executed. In July on Tuesdays and Thursdays the virus replaces 'A' and 'a' characters with the space while printing. The virus contains the text string:
C:COMMAND.COM

AAA.807

Description AAA.807

It is a harmless nonmemory resident parasitic virus. It searches for .COM files in the current directory, then writes itself to the end of the file. The virus contains the text strings:
*.COM
- AAA AAA AAA AAA AAA AAA AAA AAA.-

Home