Virus Database

Macro.Word.Switcher

Description Macro.Word.Switcher

This is an encrypted stealth Word macro virus. It contains ten macros: AutoExec, AutoOpen, AutoClose, FileClose, FileOpen, FileSave, FileSaveAs, FilePrint, FileTemplates, ToolsMacro.
The virus infects the global macros area (NORMAL.DOT) on opening an infected document, saving it, saving with new name, closing, printing and entering Tools/Macro menu. Documents get infection when they are saved, saved with new name or closed. The infection routine is placed in FileClose macro, other macros call that macro to run infection.
On closing a document if the seconds are less than 10, the virus replaces one random digit in current document. On entering Tools/Macro and File/Templates menus the virus displays the MessageBox:
Configuration conflict - menu item is not available.

Check other viruses! Be aware! Use Antiviral Software

Scity Family

Description Scity Family

These are harmless parasitic viruses.
"Scity.678,713" are nonmemory resident ones. They search for .COM files and write themselves to the end of the file.
"Scity.911,928" are the memory resident viruses. They hook INT 21h and write themselves to the end of EXE files that are executed.
They contain the text strings:
"Scity.678": KAKASHKA v2.7 - S. city , 1991
"Scity.713": KAKASHKA v2.8 - S. city , 1991-92
"Scity.911": KAKASHKA v3.21 - S. city , 1991-1992
"Scity.928": KAKASHKA v3.3 - S. city, 1991-92

Scitzo Family

Description Scitzo Family

These are dangerous memory resident parasitic polymorphic viruses. They hook INT 21h and write themselves to the end of COM and EXE files that are executed ot opened. While installing memory resident the viruses infect the C:DOSEDIT.COM file. While infecting a file they compare the file name with the string of the names of anti-virus utilities (three letters per name) and do not infect the files with the names from that string:
TBATBSF-PVSHMSATBCCPAVSAVIRSCACLETOO

Depending on the system timer the viruses append the text string to the files that are opened:
I feel a little scitzoall

The viruses also contain the strings:
C:DOSEDIT.COM
SCITZO - by "RED A", Lund, Sweden 1994

Different versions contain the strings:
"Scitzo.1285,1337": So, you've found this text?
"Scitzo.1264,1329": Fan, här går man...

Home