Virus Database

Macro.Word.Showoff

Description Macro.Word.Showoff

text (c) Michal A. Egler
This virus contains the following encrypted macros: Hayo, AutoOpen, Nomercy2, Organizer, ToolsMacro, FileTemplates.
On the 13th day of any month the virus creates the file C:WINDOWSSYSTEMNOMERCY.DLL. This file contains a debug script with the NoMercy.575 DOS parasitic virus dump code. By using this script the virus creates the virus dropper NOMERCY2.COM.
Next the virus deletes files:
C:*.BAT
C:*.SYS
C:WINDOWS*.GRP
C:WINDOWS*.DRV
C:WINDOWS*.DLL
C:WINDOWSSYSTEM*.DRV
C:WINDOWSSYSTEM*.DLL

It also inserts the following commands into the AUTOEXEC.BAT file to execute the virus dropper:
@echo off
nomercy2.com

After restarting the computer the virus code stays resident and infects each executed COM and EXE file.
The virus displays a UserDialog containing the text:
No Mercy II [Hell on WinWord], The Madness Continuesall..
wall
NoMercy II ©1997 by CrazybitS
From the land of Smoking Vulcanoes and Gamelan Orchestras
This Macro Virus Was Released for follow his brother No Mercy

Sometimes the virus changes names of macros:
Nomercy = AutoOpen
AutoClose = Nomercy2
AutoExec = Hayo
ToolsMacro = ToolsMacro
Organizer = Organizer
FileTemplates = FileTemplates

Sometimes the virus displays a UserDialog with the text:
No Mercy II Was Distrub !
Mmmmm.... you just lost your files !
Don't do it again !

Check other viruses! Be aware! Use Antiviral Software

Phantasmagoria

Description Phantasmagoria

It is not a dangerous nonmemory resident parasitic virus. It searches for .COM files of the current directory and writes itself to the end of the file. Before return to the host program it decrypts and displays the message:
PHANTASMAGORIA ! Sleep Well

It set INT 20h to JMP RESET instruction and if the host program terminates by INT 20h call, the computer reboots.

Phantom.2201

Description Phantom.2201

It is a dangerous memory resident encrypted virus. It hooks INT 21h and writes itself to the end of .COM files that are opened or executed. It infects only the files that begin from JMP command. It creates the "bad" clusters in the FAT sectors, shifts and overturns the screen, displays the message:
HI ROOKIE! I`m a THESEASE! I live in YOUR computer - sorryall Thanks to
Brains in the Computer Siences!

The virus also appends to the end of .EXE, .DBF and .ARC files the texts:
The PHANTOM Was HERE - Sorry...
Copyright (c) PHANTOM -- This virus was designed in the HUNGARIAN VIRUS
DEVELOPING LABORATORY. (H.V.D.L.)v1

Home