Virus Database

Macro.Word.Razer

Description Macro.Word.Razer

This encrypted macro virus, it contains three macros in documents and five in NORMAL.DOT. The names in NORMAL.DOT depend on local Word version, in case of Portuguese version the virus sets the second variant:
Documents NORMAL.DOT
AutoOpen AutoOpen
WinUpdate WinUpdate, FileSaveAs or FicheiroGuardarComo
WordSystem WordSystem, FileSave or FicheiroGuardar

The virus infects the global macros area on opening an infected document (AutoOpen). It writes itself to documents that are saved (FileSave) and saved with new name (FileSaveAs). On each opening an infected document the virus increases its counter (that is saved in WINWORD6.INI file). When that counter reaches 100, the virus erased the C:COMMAND.COM file.

Check other viruses! Be aware! Use Antiviral Software

ExeBug.Hooker

Description ExeBug.Hooker

This is a family of boot and multipartite stealth viruses. They hook INT 13h and write themselves to the MBR of the hard drive and boot sectors of the floppy disks. Multipartite viruses of that family overwrite the headers of EXE file with a virus dropper. Other viruses overwrite the EXE files with trojan programs that erase the hard drive sectors when infected files are executed.
It overwrites the EXE files with a trojan that contains the text string:
HOOKER

Executioner family

Description Executioner family

These are memory resident parasitic polymorphic viruses. They hook INT 21h and write themselves to the end files. "Executioner.1659,1708" infect COM files that are opened, "Executioner.2052,2304" infect EXE files that are executed.
The viruses contain the strings:
"Executioner.1659,1708":
Lame41 [Executioner]

"Executioner.2052,2304":
This is a polymorphic virus
It was written by the Executioner
It's called the lame virus #21

Executioner.2052
It is a very dangerous virus. On February 18th it erases disk C: sectors and displays the picture:
xxXXXXXXXXxx
xXXXXXXXXXXXXXX DOHHH!!
xXXXXXXXXXXXXXXXx Homer, your HaRd DrIvE is
xXXXXXXXXXXx X d3aD
XXXXXXXXXXxxxXx
XXXXXXxXXXXXx DOHHH!!
xxXXXXxxXXXXx Lotsa-luv,
XXxxx RiKkY mOuSe.

Executioner.2304
It is not a dangerous virus. On September 15th it displays:
SHATTERED/Pantera/Cowboys from Hell
It's storming broken glass, corpses left in piles
Ungracious bludgeonment that breaks the earth for miles
Nothing can stop it, the day has come, from below it's catastrophic
Freezing, there's no healing families are dying
This world is shatteredallall shattered
Life crushing turbulence, this wrath can't be denied
Wishing you could help your friends, standing where they died
Echoes haunting, a hollow planet, lacerations, dissected nation
Freezing, there's no healing families are dying
This world is shattered...all shattered

Home