Virus Database

Macro.Word97.Allen

Description Macro.Word97.Allen

This virus contains six macros in documents and nine in the NORMAL.DOT:
Documents NORMAL.DOT
AutoExec AutoExec
AutoOpen AutoOpen
FileOpen FileOpen
FileSave FileSave
FileSaveAs FileSaveAs
Tools FileMacro, FileTemplates, ToolsCustomize, ToolsMacro

The virus infects documents upon opening and saving, saving them with a new name. Upon opening an infected document, it also turns off the VirusProtection options.
In November, it displays the following message:
My heart to you
SELAMAT ULANG TAHUN..ALLEN

Upon entering the Tools/Macro menu, the virus displays the following message:
Attention:
No Macro virus In Templates

Check other viruses! Be aware! Use Antiviral Software

Eka.4096

Description Eka.4096

It is not a dangerous memory resident parasitic virus. It hooks INT 10h, 17h, 21h and writes itself to the end of COM and EXE files. To infect files the virus intercepts file execution, then search for files and infects them. Depending on its internal counter the virus changes characters that are printed. Depending on the system conditions the virus displays the picture:
+--------------------------+
| Beware of the 'Virus |
| xxxxx X xx xxxxx |
| xxxx Xxx xxxxx |
| xxxx x x x x |
+--------------------------+

Ekaterinburg

Description Ekaterinburg

It's a not dangerous memory resident boot virus. On loading from infected disk it copies itself into Interrupt Vectors Table and hooks INT 13h. Then it writes itself into boot sectors of floppy disks. MBR of hard drive is infected on loading from infected floppy. Depending on the system timer value the virus erases the screen and waits for keystroke. It contains encrypted text string "Ekaterinburg".

Home