Virus Database

Macro.Word97.Christy

Description Macro.Word97.Christy

This Word97 macro virus contains 11 macros in one module "Christy": AutoClose, AutoOpen, FileSaveAs, FileTemplates, ToolsMacro, Mutate, ChristyPayload, Retro, ToolsCustomize, ToolsOptions, ViewVBCode.
While installing into the system the virus switches off the VirusProtection option. The virus infects documents on opening and closing (AutoOpen, AutoClose, FileSaveAs), saving them with a new name .
When the Tools/Macro menu is entered, the virus displays the MessageBox:
Microsoft Word
This program has performed an illegal operation and will be shut down.

On saving documents the virus erases the anti-virus data files and programs:
C:PC-Cillin 95Scan32.dll
c:pc-cil~1*.dll
C:PC-Cillin 95Lpt$vpn.*
C:PC-Cillin 97Scan32.dll
C:PC-Cillin 97Lpt$vpn.*
C:TscPC-Cillin 97Scan32.dll
c: scpc-cil~1*.dll
C:TscPC-Cillin 97Lpt$vpn.*
C:lockavGsav.dat
C:lockavGsav.cas
C:Program FilesNorton AntiVirusViruscan.dat
C:progra~1 orton~1viruscan.dat
C:Program FilesSymantecSymevnt.386
C:progra~1symantecsymevnt.386
C:Program FilesMcAfeeVirusScan95Scan.dat
C:progra~1mcafeeviruss~1scan.dat
C:Program FilesMcAfeeVirusScan95Mcscan32.dll
C:progra~1mcafeeviruss~1mcscan32.dll
C:Program FilesMcAfeeVirusScanScan.dat
C:Program FilesMcAfeeVirusScanMcscan32.dll
C:Program FilesCommand SoftwareF-PROT95Sign.def
C:progra~1comman~1f-prot95sign.def
C:Program FilesCommand SoftwareF-PROT95Dvp.vxd
C:progra~1comman~1f-prot95dvp.vxd
C:Program FilesAntiViral Toolkit ProAvp32.exe
C:progra~1Antivi~1Avp32.exe
C:Program FilesAntiViral Toolkit Pro*.avc
C:progra~1antivi~1*.avc
C:TBAVW95Tbscan.sig
c:Tbavw95Tb*.*
C:Tbavw95Tbavw95.vxd
C:f-macrof-macro.exe
C:f-prot~1f-prot.exe

Check other viruses! Be aware! Use Antiviral Software

SoFar.254

Description SoFar.254

These are memory resident encrypted (except "SoFar.254") parasitic viruses. They copy themselves into Interrupt Vectors Table and DOS data area, hooks INT 21h, and write themselves to the end of the files that are executed.
"SoFar.254" infects only COM files. Other viruses infect both COM and EXE files. While selecting a new directory (ChDir command) or executing any file the viruses search for COM and EXE files and infect them.
"SoFar.841" deletes CHKLIST.MS file. On 29th of any month it erases the hard drive sectors and displays the message:
So Far,So Good,allSo What?

Other viruses contain the text strings:
"SoFar.254": Sh
"SoFar.973": Sh
(C) Shel,NSTU,1994,v3.1
*.exe *.com
"SoFar.988": Sh
Novosibirsk,NSTU,1994,(-) Shel,v3.1
*.exe *.com

Sofia.432

Description Sofia.432

These are not dangerous memory resident parasitic viruses. They hook INT 21h and write themselves to the end of COM files that are executed. They create the file SOFIA, display/contain the strings:
This Virus is named after a very nice, clever and cute girl, Sofia
Sweden
LoRD Zer0

Home