Virus Database

Macro.Word.Surabaya

Description Macro.Word.Surabaya

This macro virus contains six macros: AutoOpen, FileSaveAs, Autoexec, ToolsMacro, FileTemplates, Plong. It infects the global macros area on opening an infected document (AutoOpen) and writes itself to documents that are saved with new name (FileSaveAs).
While installing into the system the virus creates new profile section (the WIN.INI file):
[Author]
Name=TeBeYe`93 The ICE-Man"

When already infected Word is started (AutoExec), the virus prints to the status line the text:
Lontong Micro Device (c) 1993 By ICE-Man

Macro Plong contains the remarked text:
This Macro was created by : The ICE - "Yes" Man
Allah Swt always be with All of You all.
Surabaya, 09-09-1996

On entering File/Templates and Tools/Macro menus the virus displays the MessageBox:
Sorry...

Check other viruses! Be aware! Use Antiviral Software

Lyceum Family

Description Lyceum Family

These are not dangerous memory resident parasitic viruses. They hook INT 8, 9, 21h and write themselves to the end of COM and EXE files ("Lyceum.1975" infects COM files only).
If the keys were not pressed during a long time, these viruses display a message in Russian. "Lyceum.1832" contains the text:
Welcome to Lycee of Information Technologies !

"Lyceum.1888,1950" display:
+------------------------------------------------------------------+
¦ You are welcome ! ¦
¦ Moscow Institute of Radioengineering, Electronics and Automation ¦
¦ Moscow ¦
¦ Vernadsky Avenue 78 ¦
¦ Phone of MIREA: 433-00-66 ¦
+------------------------------------------------------------------+

"Lyceum.703" depending on its internal counter creates the README.!!! file and writes to there a message in Russian.
"Lyceum.944" depending on the current date encrypts MBR of hard drive.

LZR

Description LZR

It's a dangerous memory resident boot virus. On loading from infected floppy it writes itself in MBR of hard drive. Then it hooks INT 13h (as on loading from infected MBR) and hits boot sectors of floppies. In some cases it erases disk sectors. It contains the internal text string "LZR" also.

Home