Virus Database

Macro.Word.Puritan

Description Macro.Word.Puritan

This is a dangerous macro virus. In infects documents and global macros area (NORMAL.DOT). There are six virus macros, but there are only five different ones:
Document NORMAL.DOT
Macro1 Puritan Puritan
Macro2 Rtr Retro
Macro3 FSAB FileSaveAs
FSAB
Macro4 AOB AOB
AutoOpen
Macro5 ToolsMacro ToolsMacro

The virus infects global macros area on AutoOpen and documents on FileSaveAs. The virus deletes the anti-virus files, if they exist:
C:Program FilesNorton AntiVirusVirscan.Dat
C:Program FilesF-Prot95Fpwm32.dll
C:Program FilesMcAfeeScan.dat
C:Tbavw95Tbscan.sig

It also appends to the end of AUTOEXEC.BAT file the commands that also delete these files:
@echo off
IF exist C:Program FilesNorton AntiVirusVirscan.Dat
then del C:Program FilesNorton AntiVirusVirscan.Dat
IF exist C:Program FilesF-Prot95Fpwm32.dll
then del C:Program FilesF-Prot95Fpwm32.dll
IF exist C:Program FilesMcAfeeScan.dat
then del C:Program FilesMcAfeeScan.dat
IF exist C:Tbavw95Tbscan.sig
then del C:Tbavw95Tbscan.sig

On accessing Tools/Macro menu the virus displays the MessageBox with the strings:
Out of memory.
WordBasic Err = 7

The virus contains the comments in the Puritan macro:
The Style of macro virii was invented by
those with an Open mindall
If you have an Open mind To other influences
you will grow out as one of the best...
'Poet of the highest quality ;-) from
'--- Neophyte ----

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Italian.a

Description Macro.Word.Italian.a

Italian.a
This is an Italian Word specific virus. It does not replicate itself under any other original or local Word version. It contains three macros:
in NORMAL.DOT in infected files
FileSalva FileMacro
WordMacro1 FileChiudi
WordMacro2 FileEsci

On 7, 13, 17 and 31 of any month it displays the message (MessageBox):
C Y B E R L O R D !!
Your PC is infected by
Word.Macro.ITALIAN Virus
Written Jan,1996.

Italian.b
This is an encrypted Italian Word macro virus. It contains three macros: AutoOpen, NoMercy, AutoClose. The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are closed (AutoClose).
On entering Tools/Macro menu the virus displays the MessageBox:
-=foxz NoMercy Members=-
This Italian Virus is Made In Indonesia
Virus Name: Etna
NoMercy Product '97

The virus contains the commented text:
--------------------------------------------
a virus from NoMercy but Italian Version!
created on Yogyakarta, Indonesia
Jun 97 by foxz@biosys.net
Dedicated to my friend in Italia "D.Giovanni"
--------------------------------------------

Macro.Word.Ivana

Description Macro.Word.Ivana

The virus contains seven macros: Bold, Ivana, EditUndo, AutoClose, Underline, ToolsMacro, FileTemplates. It replicates on the documents closing.
If system time seconds value is less than 15, the virus cancels undoing (Edit/Undo calls). On Sunday the virus hides the Formatting ToolsBar, on Monday it hides the ScrollBar.
On 13th of any month the virus adds the text to the end of documents:
Na kraju, samo jos da kazem: volim te, Ivana [by utik]
And finally, I would like to say: I love you, Ivana [by utik]

On July 4th it writes the string "Ivana" to the end of the current document and sets the same password on the document.
The "Ivana" macro contains the comments:
Dedicated to Ivana, the only one
[by utik]

Home