AV_CK.508
Description AV_CK.508
It's a harmless memory resident parasitic virus. It hooks INT 21h and writes itself at the end of EXE-files that are accessed. It contains the internal text string: "AV=CK".
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Temple
Description Macro.Word.Temple
This macro virus contains four macros that have different names in documents and NORMAL.DOT:
Documents NORMAL.DOT
TempAutoExec AutoExec
TempFileSave FileSave
TempFileOpen FileOpen
AutoOpen TempAutoOpen
While loading an infected document (AutoOpen) the virus infects the global macros area (NORMAL.DOT). On saving or opening a file (FileSave, FileOpen) the virus infects the current document.
The virus does not manifest itself in any way.
Macro.Word.Tenfaces
Description Macro.Word.Tenfaces
This is an encrypted macro virus. It contains three original macros, but while infecting it copies it with 8 different names to global macros area and with 4 names to documents. While copying the virus selects random name to hide its macros:
Documents NORMAL.DOT
Macro1: AutoOpen xxxxxLove
xxxxxLove
Macro2: xxxxxAnik xxxxxAnik
FileClose
Macro3: xxxxx1109 xxxxx1109
ToolsMacro
Organizer
ToolsCustomize
FileTemplates
where "xxxxx" are random strings.
The virus infects the system on AutoOpen call and writes itself to files on AutoClose. Macro3 is a payload macro and it disables Tools/Macro, Tools/Customize and File/Templates menus as well as Organizer. On these calls the virus displays the MessageBox:
Microsoft Word
You try to Kill meallhah!, I beat your Keyboard!
It then changes the keyboard layout.
The virus also creates new variables in system profiles (WIN.INI file) in [Intl] section:
Code_Name=WORDMACRO.TENFACES
Creator=Creator of NoMercy!
Dedicated=My Love, Anik AY
|