Virus Database

Macro.Word97.CMD

Description Macro.Word97.CMD

This is a stealth macro-virus. It contains six macros: AutoOpen, AutoClose, ToolsMacro, FileSaveAs, FileTemplates, and ViewVBCode.
The virus replicates itself when documents are opened, closed or saved with a new name (AutoOpen, FileClose, FileSaveAs). The virus disables the VirusProtection option.
Upon entering the Tools/Macro and File/Tamplates menus, it displays the Balloon:
Help
You do not have permission to do this. Please refer to the instruction
manual for further details.

On October 16, it displays the MessageBox:
Coded By: DarkChasm
CMD (C) DarkChasm

On december 21, it displays the MessageBox:
Christy
I LOVE CHRISTY

Check other viruses! Be aware! Use Antiviral Software

Riot.278.a

Description Riot.278.a

Riot.278, 279, 282, 392, and Tower.411
These are harmless memory resident parasitic viruses. Upon being executed, they copy themselves into a interrupt vector table, and hook INT 21h. They write themselves to the end of executed or closed files. "Riot.393" also infects files that are opened or renamed. "Riot.282" infects COM files only; "Riot.278 and 392" infect both COM and EXE. These viruses contain text strings:
"Riot.279,281,282": EXTASY! (c) Metal Militia / Immortal Riot
"Riot.392": RAVAGE! (c) Metal Militia / Immortal Riot

"Riot.Tower.411" displays:
Tower Virus (c)1994
Thiss vihruws riten bi a prawducked af thee waauren woulds skoul distriks.

Riot.355
This is a memory resident overwriting virus. It hooks INT 21h, and overwrites all files that are executed. It contans/displays the strings:
Marked-X
Will we ever learn to talk with eachother?
(c) Metal Militia/Immortal Riot
In any country, prison is where society sends it's
failures, but in this country society itself is faily
Bad command or filename

Riot.426 and 428
These are dangerous non-memory resident parasitic viruses. They search for COM files of the current directory, and write themselves to the end of the file. In some cases, they display the message "ARBEIT MACHT FREI!" or erase disk sector. The viruses also contain the text string:
The Unforgiven / Immortal Riot Sweden 01/10/93

Riot.723, 724, F ace, RedMercury, Stioxyl, and Uniq
These are dangerous non-memory resident encrypted parasitic viruses. They search for COM files, and write themselves to the end of the file. They overwrite a DOSKEYB.COM file with a Trojan program, delete the files, and erase the disk sectors. The viruses contain the text strings:
"Riot.723 and 724":
ImmortalRiot [BAD ATTITUDE!]
(c) '94 The Unforgiven/Immortal Riot
dos doskeyb.com
"Riot.Face":
Faces of Death - (c) 1994 The Unforgiven/Immortal Riot
DOSEDIT.COM
c:doskeyb.com
Materialism - the religion of today, ain't it sad?
"Riot.Stioxyl":
[Stioxyl] (c) '94 The Unforgiven/Immortal Riot
DOSEDIT.COM
"Riot.RedMercury":
I hereby annex this sector as the property of IR!
Red Mercury (c) '94 The Unforgiven/Immortal Riot
*IR.COM
c:doskeyb.com c:autoexec.bat c:config.sys c:command.com
"Riot.Uniq":
[UNiQ](c) 1994 Metal MilitiaImmortal Riot, Sweden
c:doskeyb.com

Riot.789
This is a dangerous non-memory resident virus. By using the masks "*.COM and *.EXE", it searches for .COM and .EXE files on the C: drive, and overwrites them. It creates the C:INFERNAL.IR file to where it writes the message: Infernal Demand! (c) Metal Militia / Immortal Riot Your misery is our pleasure! Your nightmare is our dream! Your hell is our paradise! Your lost is our demand! Your cry is our laugh! And your fate is ours!
Riot.1203
This is a benign non-memory resident encrypted parasitic virus. It searches for .COM files of the directory tree, and writes itself to the end of the file. In some cases, it leaves a memory resident program, which hooks INT 8 and displays:
Another year passed by
Another tear the willows crys
to change the world we ever try
to make a difference before we die
[PSYCHOSIS] Greets, Phalcon/Skism.
(c) 93/94 The Unforgiven / Immortal Riot

It also contains the string:
\ Merry Xmas and a happy new year // Sweden - Snowing Again

Riot.Aladdin
This is a dangerous non-memory resident encrypted parasitic virus. It searches for .COM files and writes itself to the end of the file. It erases CMOS, disk sectors, and displays the following messages:
DEBUGGING IS VERY ILLEGAL (NOT!)
I am an assasin, I want to and shall kill you!
I also hate Aladdin and will also kill it!
I will eliminate you with the touch of just one finger
Look at my revenge! Crying wont help you!
I am a dangerous virus, I live! I am created by:
The [HACKING HELL] !!!!
Fear me! I am more powerfull than GOD!
Aladdin Killer #1
Hacking Hell
I-EAS Virus Creation Centre v0.19ƒÒ
[AK] [HH] [IE-VCC v0.19ƒÒ]
XXX-Rated

Riot.BadReligion
These are dangerous non-memory resident encrypted parasitic viruses. They search for COM files and write themselves to the end of the file. Depending on the system time, they erase the disk sectors. They contain the text strings:
[Bad Religion] (c) 1994 The Unforgiven/Immortal Riot
DOSEDIT.COM *.com

Riot.Caffeine.366
This is a dangerous non-memory resident encrypted parasitic virus. It searches for .COM files, and writes itself to the end of the file. Depending on the system time, it leaves a memory resident program that hooks INT 21h and erases the files that are executed. The virus contains the text string:
[Caffeine] (c) 1994 The Unforgiven/Immortal Riot*.com

Riot.CarpeDiem
This is a dangerous non-memory resident encrypted parasitic virus. It searches for .COM files, and writes itself to the end of the file. Depending on the system timer, it erases the MBR of the hard drive and displays the following message:
CARPE DIEM! (c) '93 - Raver/Immortal Riot

It also contains the text string:
Sweden 16/11/93*.com

Riot.CarpeDiem.1012 and 1033
These are benign memory resident encrypted parasitic viruses. They hook INT 21h, and write themselves to the end of COM files that are executed or closed. They contain/display the text strings:
CARPE DIEM! - SIEZE THE DAY!
(c) '95 The Unforgiven/Immortal Riot
Kudos to Raver, Conzouler & King_Dan! Program infected!

Riot.CarpeDiem_II
These are benign memory resident encrypted parasitic viruses. They hooks INT 8, 9, 21h, and write themselves to the end of COM files that are executed or closed. When an infected file is opened, the viruses disinfect it. The viruses displays the following messages:
"Carpediem_II.1299,1305": CARPE_DIEM_II - FLOATING THROUGH THE VOID!
"Carpediem_II.1336": HERMANNI BLOWS FRISK'S LITTLE DICK BLUE!
"Carpediem_II.1409,1415": CALL 0910-14000 for a CURE!
This virus was written by The Unforgiven/Immortal Riot

They also contain the text strings:
"Carpediem_II.1299,1305": SVW: The Unforgiven/Immortal Riot
Fuck Corporate Life!
"Carpediem_II.1336": AND YOU ARE IT! [DeathRider]
"Carpediem_II.1409,1415": Fuck you Ratman!
It's some version of CARPE DIEM_II!

Riot.Coke.535
This is a benign non-memory resident parasitic virus. It searches for .EXE files, and writes itself to the end of the file. It contains bugs, and replicates only from files about 340K in length. On the 1st of any month, it displays:
Love to LISA :)

It also contains the strings:
Cocaine [CoKe](c) Metal Militia/Immortal Riot
Cocaine's running thrue your vainsIt seems you have become an addict
*IR.EXE

Riot.Conjurer and Riot.Immortal
These are benign non-memory resident parasitic viruses. They search for .COM files, and write themselves to the end of the file. The viruses display the following messages:
"Riot.Conjurer.270": CoNJuReR.BSC!
"Riot.Conjurer.300": CoNJuReR.300!
"Riot.Conjurer.433": Ajax is kampioen, Ajax blijft kampioen,
er is nog geen club die daar iets aan kan doen!
CoNJuReR.AJAX Rulez! [iMMoRTaL EAS]
Ajax won UEFA-Cup 1995!!!
"Riot.Conjurer.Tng": Diz mezzie iz printed by:
CoNJuReR.TNG (The Next Generation!)
"Riot.Conjurer.VCC.269": Test Virus #1 Hacking Hell
I-EAS Virus Creation Centre v0.19ƒÒ
[T1] [HH] [IE-VCC v0.19ƒÒ]
"Riot.Conjurer.VCC.408": DEBUGGING IS VERY ILLEGAL (NOT!)
Test Virus #2 Hacking Hell
I-EAS Virus Creation Centre v0.19ƒÒ
[T2] [HH] [IE-VCC v0.19ƒÒ]
"Riot.Conjurer.VCC.586": DEBUGGING IS VERY ILLEGAL (NOT!)
Test Virus #3 Hacking Hell
I-EAS Virus Creation Centre v0.19ƒÒ
[T3] [HH] [IE-VCC v0.19ƒÒ]
"Riot.Immortal.265": iMMoRTaL.263!!
"Riot.Immortal.353": iMMoRTaL.358!!
"Riot.Immortal.377": iMMoRTaL.377 {{Encrypted!!}
"Riot.Immortal.510": iMMoRTaL.510 {{Encrypted!!}
"Riot.Immortal.550": iMMoRTaL.550!!

Riot.DDeath
This is a harmless memory resident encrypted parasitic virus. It hooks INT 21h, and writes itself to the end of COM and EXE files that are executed or closed. It contains the text string:
Digital Death - v0.90ƒÁ (c) '94 Raver/Immortal Riot

Riot.Digital
This is a dangerous memory resident encrypted parasitic virus. It hooks INT 21h, and writes itself to the end of COM files that are executed or opened. Depending on the system date and time, it beeps through a PC speaker or erases CMOS. It contains the text string:
Digital Pollution (c) '94 Raver/Immortal Riot

Riot.Doom
This is a benign non-memory resident encrypted parasitic virus. It searches for EXE files, and writes itself to the end of the file. It occupies some of the system memory after execution, but does not hook system interrupts. It contains the string:
DOOM! (c) '93 Raver/Immortal Riot

Riot.Enemy.757
This is a dangerous memory resident virus. It hooks INT 21h, and infects the files that are executed. While executing a Filename.Ext file, the virus creates Filename.Exe files, and writes itself into it. As a result, .EXE files are overwritten, and .COM files are completed with companion .EXE files. This virus contains the texts:
Unknown Enemy
(c) Metal Militia/Immortal Riot
I'm hurt, machineguns firing behind my back
Never had no chance, no way to do a attack
Thisone sure is the last time i guess
Heading for a private deathrow, nothing less
Blood, quickly pumping out from the vound in the vain
Damn, this moment makes you sort of go insane
Close my eyes, had much left to see
Was my fault, but did they have to do it, gee?
Promise me, this hit you will remember
Take one of them down before winter comes in december
Why that month? Well, i like it very much
Fresh, cool air, wonders of the snow to touch
The world is wonderful, what else to say?
Just remember this shit, cause it happends every day

Riot.Eternity
These are non-memory resident parasitic encrypted viruses. They search for EXE files, and write themselves to their end. "Riot.Eternity.562 and 565" are harmless viruses, "Riot.Eternity.600", depending on the system timer, erases disk sectors. They contain the following texts:
"Riot.Eternity.562 and 565": [ETERNITY!] (c) '93 The Unforgiven/Immortal Riot
"Riot.Eternity.599,600": Eternity_II (c) '94 The Unforgiven/Immortal Riot..

Riot.Evil
This is a harmless memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of COM files that are executed. It contains the following texts:
Our past is our future!
[INVISIBLE EVIL!] (c) Metal Militia/Immortal Riot
Dedicated to all the victims..
Greets to B-real!/IR
It's like this and like that and like thisena
It's like that and like this and like thatena
It's like this..
Love to Lisa!
All i ever wanted..
All i ever asked for..

Riot.Evil.811
This is a very dangerous variant of the "Riot.Evil" virus. On the 31st of any month, it erases the disk sectors. It contains the following texts:
!BIOHAZARD!U Found ME!
BIOHAZARD VIRUS - INV. EVIL ALTER - THE Wƒ"ƒƒ$ƒÜL!
HEY HEY TO ALL A/V LAMERS!! HA!
Greets to B-real!/IR
Well, The Wƒ"ƒƒz is back, and he has an attitude!
Quit reading the code, yes, this is a fucking virus!
Catch me, Dare ya!
The Wƒ"ƒƒ$ƒÜL!!!!
Are you done yet???
Fuck this, Later C:!!!

Riot.Fire.473
This is a benign non-memory resident parasitic virus. It searches for .COM files, and writes itself to the end of the file. This virus contains/displays the following messages:
Fight Fire With Fireall
*.COM
Soon to fill our lungs the hot winds of death
The gods are laughing, so take your last breath
Immortal Riot..Death Greets me warm..

Riot.Hybris
This is a benign memory resident encrypted stealth virus. It hooks INT 21h, and writes itself to the end of COM files that are executed or closed. While opening an infected file, the virus disinfects it. The virus may hook INT 8, 9, or 16h, and runs itself with a video effect, and displays the following messages:
THIS PROGRAM IS (C) 1995 IMMORTAL RIOT
[HYBRiS] (c) '95 =TU/IR=

Riot.Insine.1026
This is a dangerous memory resident parasitic virus. It hooks INT 21h, and writes itself into the middle or beginning of COM files that are executed or closed. Depending on the system timer, it erases the disk sectors and displays:
Insane Reality..
The Unforgiven / IR..

Riot.Maria
This is a dangerous non-memory resident parasitic virus. It searches for .COM files of the directory tree, and writes itself to the end of the file. On the 2nd of every month, it erases the disk sectors. In some cases, it leaves a memory resident program that hooks INT 8 and displays:
Maria K lives..
Somewhere in my heart..
Somewhere in Sweden..
I might be insane..
But the society to blame..
The Unforgiven / Immortal Riot

Riot.Marked.354
This is a dangerous memory resident overwriting virus. It hooks INT 21h, and overwrites the files that are executed. It contains/displays the texts:
Marked-X Will we ever learn to talk with eachother?
(c) Metal Militia/Immortal Riot
In any country, prison is where society sends it's
failures, but in this country society itself is faily
Bad command or filename

Riot.Mega
This is a benign non-memory resident encrypted parasitic virus. It searches for .COM files, and writes itself to the end of the file. It contains/displays the messages:
DEBUGGING IS VERY ILLEGAL (NOT!)
You computher is now infected with:
MEGA-DESTRUCTION
The Conjurers....
Mega Destruct Hacking Hell
I-EAS Virus Creation Centre v0.19ƒÒ [MD] [HH] [IE-VCC v0.19ƒÒ]

Riot.Moonlite.458
This is a dangerous non-memory resident parasitic encrypted virus. It searches for .COM files, and writes itself to the end of the file. On Mondays, it leaves a memory resident program that hooks INT 21h and deletes the files that are executed; this program also hooks INT 9, and reboots a computer when the DEL key is pressed. This virus contains/displays the following messages:
Metallic Moonlite
(c) Metal Militia/Immortal Riot
Greetings to The Unforgiven/IR
Bad command or filename

Riot.Multi
These are dangerous memory resident parasitic viruses. They hook INT 21h, and write themselves to the end of COM files that are executed. On the 1st of any month, they erase the disk sectors. They contain the text strings:
COPY ME, SO I CAN TRAVEL!!!!!
Why am i so fly? ;)
Mmm.. Mmm.. Mmm..
For the smell of it!!!!!
MULTIMULTIMULTIMULTI
MULTI-FLU v1.0
(c) 1994 Metal Militia
Immortal Riot
Sweden
All viruswriters worldwide
ƒ"are to be gratulated!!!!!
FLUFLUFLUFLU
Written during SUMMERTIME!!!!!
Happy happy! Joy joy!
Winterkvist is.
a looser!!!!!
Greetings to the rest
of IMMORTAL RIOT
This is property of IR

Riot.Multiplex
These are dangerous non-memory resident parasitic viruses. They search for .COM files, and write themselves to the end of the file. On the 5th of each month, they erase the C: disk sectors. They contain the text strings:
MULTiPLEX (c) 1994 Metal Militia
Immortal Riot, Sweden
Somewhere, somehow, always :)
*.com ImRio

Riot.Overdoze
These are harmless memory resident parasitic viruses. They hook INT 21h, and write themselves to the end of COM files that are executed. They contain the text string:
[Overdoze] (c) 1994 The Unforgiven/Immortal Riot

Riot.Psychosis.1195
This is a benign memory resident encrypted parasitic virus. It searches for .COM files and writes itself to the end of the file. It contains the text string:
\ Merry Xmas and a happy new year // Sweden - Snowing Again

Sometimes it leaves a memory resident program that hooks INT 8 and displays:
Another year passed by
Another tear the willows cry
to change the world we ever try
to make a difference before we die
[PSYCHOSIS] Greets, Phalcon/Skism.
(c) 93/94 The Unforgiven / Immortal Riot

Riot.Radiation
This is a benign non-memory resident encrypted parasitic virus. It searches for EXE files, and writes itself to the end of the file. It deletes the CHKLIST.MS file. Depending on system date, it displays the following messages:
[RADIATION] .oO 1995 by CoKe Oo.
Your hate is my love,
your lie is my truth!
But love can be hate,
and truth can be a lie!

The also virus contains the text strings:
CHKLIST.MS
Made in Luxembourg 1995
To MANDY, the greatest girl I know !
Thanks to Metal Militia

Riot.Salamander
These are harmless memory resident encrypted parasitic viruses. They hook INT 21h, and write themselves to the end of COM files that are executed or closed. While opening an infected file, the viruses disinfect it. The viruses contain the text strings:
"Salamander.888": [- Salamander Four -] (c) by Blonde/IR 1995
"Salamander.940": [- Salamander Four -] (c) by Blonde in 1994

Riot.Sturm
These are dangerous non-memory resident encrypted parasitic viruses. They search for EXE files, and write themselves to the end of the file. Depending on the system date, they erase the disk sectors. They contain the text string:
[Stƒ#rm und Drang!] (c) '94 The Unforgiven/Immortal Riot*.EXE

Riot.sUMsDos.472
This is a dangerous memory resident parasitic virus. It hooks INT 1Ch and 21h, and writes itself to the beginning of COM files that are executed. It checks the screen buffer for the "sUMsDos" string, and erases disk sectors if such a string is found.
Riot.TTT
These are dangerous ("TTT.840" is benign) non-memory resident encrypted parasitic viruses. They search for COM or EXE files (depending on the virus version), and write themselves to the end of the file. Depending on the system date, "TTT.712 and 1063" erase the disk sectors. They contain/display the text strings:
"Riot.TTT.712":
The Tea, Toasts, and Titties virus 1.00EXE
You are screwed by a swedish virogen!
This virus is freeware, feel free to distribute!

"Riot.TTT.840":
This virus is a direct-action infector of .com files that will search for files
to infect in the current, DOS and in any directories below this. If it find an
un-infected comfile it will be infected, though it will still work as before. The virus
is freeware, and you are allowed and even encouraged to copy it and send it to your friends.
The Tea, Toasts and Titties virus v1.00Made in Sweden 1994

"Riot.TTT.1063":
This is The Tea, Toasts, and Titties virus v1.1. It is very destructive
and will spread to some of your com files. Please distribute as much as
you want. Any damage caused by this virus is appreciated. Beware [TTTT]
Live now and don't die courious!
Legalize everything!
Fucking is nice - don't die vir(o)gen!
Bad Religion! - Alah ƒÕlskar dig.. nƒÕr du ƒÕr dƒèd!
Stoppa rasismen, krossa facismen!
och dďd ąt politikerna!!
Raseri.. ANARKI! Och! ƒÕlska mig.. la-la-la.. bara MIG!.. !!

Riot.Dial.1529

Description Riot.Dial.1529

It is a very dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed or closed. The virus compares two first symbols of the file name with the list:
SC TB F- SM TO FI MS VI

and while executing such program either formats the hard drive sectors, or displays the message and halts PC:
Program cannot be executed. Infected with Manzon by Red-A of Immortal Riot.
Reboot and remove this very virulent virus!
System Halted!

The virus also hooks INT 8, 9 and "shakes" the screen (INT 8), or displays the message on pressing Alt-Ctrl-Del (INT 9) :
DIAL 911 FOR RESCUE! YOU CAN'T REMOVE THIS VIRUS YOURSELF!

The virus also contains the text strings:
[Insert virus_name and your nickname at this place manually!]

Home