Virus Database

Macro.Word97.Biok.a

Description Macro.Word97.Biok.a

This macro virus contains eight macros in module "BiosKiller": AutoExec, Document_Open, FileSaveAs, FileTemplates, HelpAbout, PayBiosKiller, ToolsMacro, ViewVBCode. The global macros area (NORMAL.DOT) gets infection when an infected document is opened (Document_Open). The virus spreads itself to other documents on their saving with new name (FileSaveAs). The virus copies its code from file to file by using Import/Exports VisualBasic calls via the C:BK.SYS and C:APVBK.SYS disk files.
The virus disables the Word VirusProtection. On entering the FileTemplates menu the virus displays the MessageBox:
Virus BiosKiller
Vous feriez mieux de vous acheter un AVall

On entering the ToolsMacro menu the virus displays the MessageBox:
Virus BiosKiller
Je suis un virus comme CIH...

On starting MS Word at 16 minutes of any hours or at 26 seconds of any minute the virus displays the MessageBox:
Virus BiosKiller
Vous connaissez le virus CIH ?
Je fais la même chose que lui...

On starting MS Word on 26th of any month the virus displays the MessageBox:
Virus BiosKiller
Votre Bios va subir des changements...
HAHAHAHAHA

It then creates the C:CMOS.BAS, writes a CMOS-erasing instructions to there and executes it with a help of DOS QBASIC utility. The virus then calls the ExitWindows function.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Caffeine

Description Macro.Word.Caffeine

This virus contains only one macro AutoOpen and replicates on opening documents. While infecting the virus depending on the random counters displays the UserDialog containing the string "Give me caffeine!" and waits for "caffeine" or "coffee" input.

Macro.Word.Candyman.a

Description Macro.Word.Candyman.a

The macro viruses of this family contain three macros:
"Candyman.a": Autoopen, Candyman, AutoClose
"Candyman.b": Autoopen, Dyatrima, AutoClose

They infects the global macros area on opening an infected document (AutoOpen), and infect other documents on their closing (AutoClose).
On 25th of any month the "Candyman.a" virus deletes all files in folders C:WINDOWS and C:DOS. Then it displays the message:
No se olviden de CABEZAS -Pierri y Duahlde
PUTOS-Cabezas Virus by CANDYMAN Bs. As. Argentina

The "Candyman.b" virus drops and executes the DYA.COM file infected by the DOS overwriting virus "HLLO.Candym".

Home