Virus Database

Macro.Word.Sidor

Description Macro.Word.Sidor

This macro virus contains five macro in documents: AutoOpen, FileClose, FileTemplate, mir, ToolsMacro (stealth). In NORMAL.DOT It contains seven macros: AutoExec, ToolsMacro, FileTemplate, FileSave, FileSaveAs, fucker, sokker.
The virus infects the global macros area on opening an infected document and copies itself to other documents on saving or saving with new name. While infecting the virus uses anti-heuristic trick: it creates four temporary macros, writes infection routines to there, executes these macros and then deletes them.
The virus contains the comments:
Write by Sidorov Konstantin Matveevich, 73 years old, der. Vioshki,
Moscowskaya obl.
Sorry me, old grandfather, for some errors

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.KillSystem.a

Description Macro.Word.KillSystem.a

These are very dangerous viruses. They contain only one macro - Autoexec or AutoOpen depending on the virus version. On the 1st of any month these viruses delete the files: C:COMMAND.COM, C:AUTOEXEC.BAT, C:CONFIG.SYS. The viruses also contains texts in Chinese.

Macro.Word.Killuf family

Description Macro.Word.Killuf family

The viruses of this family contain three macros: AutoClose, VisioOpen, VisioClose. They spread on closing document (AutoClose). During infection they do not copy themselves to documents, but move. After copying they delete themselves in original document. They keep the name of current document in the WINWORD6.INI file in the [Microsoft Word] section with the name LUF01.
Starting from January 1st 1999 they erase the files on all drives in all directories: *.DOC, *.PPT, *.XL?, *.MPP, *.WPS, *.MDB. Then the MessageBox is displayed
HAPPY NEW YEAR FOLKS!

Home