Macro.Word97.Alamat
Description Macro.Word97.Alamat
This is a dangerous macro-virus. It uses an ordinary way to spread - it infects the global macros area upon opening an infected document, other documents get infected upon their opening or closing.
The virus has many payload routines. Each of them is activated only one day per month:
1 - the virus inserts in document the text:
Alamat brought to you by Lucky Warrior
2 - disables "Table" menu command
3 - disables "Help" menu command
4 - deletes all files in root folder of drive C:
5, 25, 27 - deletes all files in folders:
C:progra~1Drsolo~1Anti-V~1*.*
C:Program FilesNorton~1*.*
C:progra~1mcafeeviruss~1*.*
C:progra~1pc-cil~1*.*
6 - deletes all files in "C:Windows" folder
7 - saves documents with password "Alamat"
8 - prints document with added note "Your're infected with the Alamat virus!"
9 - changes Windows registerd onwer name to "Lucky Warrior"
10, 30 - deletes all files in "C:Windows" and "C:Winnt" folders
11 - deletes one character at cursor position.
12 - opens "www.playboy.com" site
13 - displays Office Assistant with message:
Warning!
Ms Word is suffering from unknown virus!
14 - modifies the system registry to display a message before system log-on:
Lucky Warrior
Welcome to the world of Alamat!
15 - replaces all "of" words by "Alamat" and then deletes commands "Replace" from menu
16 - hides Office Assistant and mouse cursor
17 - changes Word window caption to "Alamat"
18 - disables "File" menu item
19 - exits Word just after document open
20 - deletes all files in "C:Progra~1System" folder
21 - disables "Edit" menu command
22 - disables "View" menu command
23 - disables "Insert" menu command
24 - disables "Format" menu command
26 - exits Windows
28 - changes Word user information:
UserName = "Lucky Warrior"
UserInitials = "LW"
UserAddress = "Bgy. Tiguib, O.E.S."
29 - disables "Window" menu command
Check other viruses! Be aware! Use Antiviral Software
Lucifer Family
Description Lucifer Family
These are dangerous memory resident parasitic polymorphic viruses. They hook INT 21h and write themselves to the end of COM files that are executed or opened. The viruses have the bugs, and may corrupt the files while infecting them, and infect non-COM files. The viruses contain the text strings:
"Lucifer.1799": Lucifer Messiah [PROTO 2ß]
LuciferBoot.a
Description LuciferBoot.a
It's a not dangerous not memory resident boot virus. On loading from infected floppy it overwrites boot sector of C: drive, on loading from infected hard drive it overwrites boot sectors of B: drive. It does not save original boot sector and tries load DOS by itself. If there are not system files on current disk this virus displays: "Sys?". This virus does not hook interrupt vectors and does not install itself memory resident. It contains the internal text strings:
Lucifer
Lucifer Messiah -- ANARKICK SYSTEMS v6.1 (c)1990
Sys?
|