Macro.Word97.Argh
Description Macro.Word97.Argh
The virus code contains fifteen macros in one module "NewMacroses". The virus spreads on creating, opening, closing documents as well as on exiting Microsoft Word. On infecting the system the virus copies original NORMAL.DOT to user template directory with the WINDOT.DLL name, and infected NORMAL.DOT with the WININF.DLL name.
On selecting the ToolsMacro menu the virus checks the number of opened documents. If no documents are opened, the virus displays the message:
Microsoft is protecting your normal.dot from virus infection You can
only add macros to other documents
Otherwise the virus removes itself from normal template and on leaving the ToolsMacro dialog window reinfects it.
While infecting the virus with probability 2% displays the assistants balloon:
Help me
I'm not feeling very vell .. AAARGHH!!!
Check other viruses! Be aware! Use Antiviral Software
Rajaat.518
Description Rajaat.518
Rajaat.518 is a dangerous memory resident multipartite virus. During execution of an infected file the virus hits the MBR of the hard drive. While infecting it redirects the active boot sector to the virus body (see Starship virus). On loading from infected MBR it hooks INT 13h, 21h and writes itself at the end of .COM-files on writing (INT 21h, AH=40h) to them. It hits COMMAND.COM file. It may cause the system crash on DOS loading. The virus contains the internal text string:
[Andropinis] by Rajaat
Ramesy.336
Description Ramesy.336
It is a dangerous nonmemory resident parasitic virus. It searches for COM files, then writes itself to the beginning of the file. Because of error it corrupts COM files of small length. It contains the text string:
[RAMESY] Coaxial Karma/94 *.COM
|