Virus Database

Macro.Word.Uglykid

Description Macro.Word.Uglykid

This is a polymorphic Word macro virus. It contains one macro in documents: AutoOpen, and two macros in NORMAL.DOT: FileSave, ToolsMacro. The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are saved (FileSave).
The virus uses quite complex polymorphic engine - different infected files have variable sets of commands in virus' macros. The virus also uses quite complex way to hide its main code in documents and templates: the main virus code is placed in AutoText area and virus' macros just read it from there, copy the text to macros area and execute it. This is the first known virus that uses such way to hide itself.
The virus sets the user's name to "Nasty". The polymorphic engine has bugs, as a result it may produce corrupted code.

Check other viruses! Be aware! Use Antiviral Software

Dark.1016

Description Dark.1016

These are very dangerous non-memory resident parasitic viruses. They search for COM (except COMMAND.COM) and EXE files, then write themselves to the end of the file. On Mondays, if it is the 16th day of the month, the viruses overwrite the boot sector of the current drive with a Trojan program that reboots a computer when executed; then the viruses display the following message:
Welcome to the Dark Apocalypseall Your computer will
never escape... You might as well read this and weep!
The Dark Apocalypse v1.00 by Crypt Keeper [RoT]
TTReign of TerrorTT [DARK APOCALYPSE]
Press any key to continue...

and print the screen by a INT 5 call, and reboot a computer. These viruses also contain the text strings:
COMMAND.COM *.EXE *.COM

DarkElf (boot)

Description DarkElf (boot)

It is a dangerous memory resident stealth boot virus. It hooks INT 3, 8, 13h and writes itself to the boot sectors of the floppy disks that are accessed. While infecting a disk the virus stores its second sector and original boot sector to the FAT sectors, and infects correctly 360K floppy disks only. While installing memory resident, if the virus cannot locate the original boot sector, it formats the disk sectors, then display and prints the message:
The Dark Elf strikes again!

It also contains the text strings:
V.I.R.U.S. Rules!
DARKELFv0.1

Home