Virus Database

Macro.Word97.Akuma

Description Macro.Word97.Akuma

It is a dangerous macro virus. It infects global macro area on opening an infected document. Other documents get infection also on their opening. The infection routine finds virus procedures separately and stores them into the disk file "C:CONT.DBL". When victim document is infecting the routine adds the code from this file to document without destroying document's macros, except "Document_Close" and "Document_Open" macros. It makes the virus more stealthy.
In one case of two the virus changes document's summary information:
Title = "Akuma Macro Carrier"
Author = "Akuma"
Keywords = "Mary Bitch"

The virus sets recent edited files list size to maximum - nine files (every opened file MS Word adds in this list). On document closing the virus checks the system date and if the day is 16, 17 or 18 executes payload routine. This routine looking for file "C:MARY.LOG" that must have "hidden" and "read only" attributes set and if it doesn't found overwrites all files from recent files list. The virus replaces content of this files on text:
Something wonderful has happened, your PC is alive and even better but some
of your documents are infected by the Akuma virus.
Mary is simply a bitch and you, <UserName>, are a stupid jerk and
lose some files.
Have a nice day.

After that the files are almost unrecoverable.

Check other viruses! Be aware! Use Antiviral Software

Slost.596

Description Slost.596

It is a harmless nonmemory resident parasitic virus. It searches for COM files, then writes itself to the end of the file. The virus uses anti-debugging tricks, and contains the text strings:
*.com
* LOST *

Slovakia.1056

Description Slovakia.1056

This a harmless non memory-resident encrypted parasitic virus. It searches for COM files, then writes itself to the end of the file.

Home