Virus Database

Macro.Word97.Badmacro.a

Description Macro.Word97.Badmacro.a

This virus contains two macros AutoOpen and AutoClose, and replicates upon document opening or closing. Upon closing a document, starting from the 23rd of any month, the virus creates and executes the "C:QSTART.COM" Trojan file clearing the CMOS memory. The virus has Russian origin: on the 1st and 13th of any month, it replaces, in the current document, the Russian words "here" with "there". The virus also sets the description attributes for its macros:
AutoOpen: Absolutely bad macro (in Russian)
AutoClose: Reread Version 1.2!

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Horn

Description Macro.Word.Horn

This virus contains two macros: AutoOpen, LittleHorn. It writes itself to the global macros area on opening an infected document (AutoOpen). The virus infects documents on pressing the "e" key - to do that it intercepts keyboard events. The virus does not manifest itself in any way.

Macro.Word.Hot

Description Macro.Word.Hot

This is encrypted virus. It contains the macros: AutoOpen, InsertPBreak, DrawBringInFrOut, ToolsRepaginat. While infecting the system that virus renames the ToolsRepaginat macros to FileSave, and then infects the existing documents that are saved on disk (FileSave). While infecting the documents the virus renames FileSave macro back to ToolsRepaginat name.
While infecting the system the virus inserts the string "QLHot=nnnn" into the WINWORD6.INI file, where "nnnn" is the "triggering day", it is the number of current day of this century plus 14, for example:
QLHot=35110

The next days the virus selects random value from 1 till 6, and adds to the "triggering day". If the result is equal to the current day, the virus deletes the file before saving it to disk.
14 days after last modifying of the "QLHot" string the virus renews it.
The virus does no action if there is the C:DOSEGA5.CPI file.
The virus does not work under Microsoft Word 7.0. While opening the infected document the system displays the message:
Unable to load specified library

Home