Virus Database

Macro.Word97.Colombia

Description Macro.Word97.Colombia

It is a dangerous stealth macro virus. It contains seven macros in one module "NewMacros": AutoOpen, AutoClose, AutoNew, AutoExec, kill, unprotect, engendrar.
It infects the global macros area on opening an infected document (AutoOpen) and infects other documents on opening, creating and closing (AutoOpen, AutoNew, AutoClose).
The virus turns off the Word virus protection (the VirusProtection option). It also disables the Tools/Macro, View/Toolbars menus (stealth).
On each infecting (on automacros executing) it tries to format floppy disk in the A: drive, prints to the status bar the text "Linea <Counter number> Esquema a" and increases its counter by one. If this counter exceed 99, the virus deletes all data on the C: drive by executing DOS command FORMAT.COM in hidden DOS window.
On closing each document the virus displays to the status bar:
Publicidad para Colombia!!

The virus also contains the strings:
COLOMBIA
*** Salvado por Colombia ***
Se salvã el Diskette

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Aleja

Description Macro.Word97.Aleja

The virus contains six macros: AutoClose, AutoOpen, ArchivoGuardar, ArchivoGuardarComo, ArchivoImprimir, ArchivoImprimirPredeter.
The virus spreads on opening, saving documents or saving them with new name. To hide its code the virus disables the ToolsMacro menu. It also turns off the VirusProtection option.
Before document printing, the virus replaces primary header with the text:
Documento infectado con el virus ALEJA5

Macro.Word97.Aljadezz

Description Macro.Word97.Aljadezz

This is the polymorphic macro virus. It contains twelve macros in the module "aljadezz": FileSaveAs, Mutate, EditFind, AutoOpen, FileSave, FilePrint, Inserta, ToolsMacro, ViewVBCode, ToolsCustomize, FileTemplates, Retro.
The virus replicates on executing one of the macros: FileSaveAs, EditFind, AutoOpen, FileSave, FilePrint. It uses polymorphic routine inserting random comments into the virus code.
The macro EditFind erases the system files:
C:WINDOWSWIN.COM
C:CONFIG.SYS
C:AUTOEXEC.BAT
C:COMMAND.COM

On printing (FilePrint) the virus adds a page with the text:
-=INFECTADO CON EL ALJADEZZ VIRUS=-

The virus then deletes the files:
C:WINDOWS*.*
C:*.*

The virus also erases the anti-virus programs:
C:Archivos de ProgramaAntiViral Toolkit ProAvp32.exe
C:progra~1Antivi~1Avp32.exe
C:Archivos de ProgramaAntiViral Toolkit Pro*.avc
C:progra~1antivi~1*.avc
C:f-macrof-macro.exe
C:f-prot~1f-macro.exe
C:Archivos de ProgramaCommand SoftwareF-PROT95Sign.def
C:progra~1comman~1f-prot95sign.def
C:Archivos de ProgramaCommand SoftwareF-PROT95Dvp.vxd
C:progra~1comman~1f-prot95dvp.vxd
C:Archivos de ProgramaMcAfeeVirusScan95Scan.dat
C:progra~1mcafeeviruss~1scan.dat
C:Archivos de ProgramaMcAfeeVirusScan95Mcscan32.dll
C:progra~1mcafeeviruss~1mcscan32.dll
C:Archivos de ProgramaMcAfeeVirusScanScan.dat
C:Archivos de ProgramaMcAfeeVirusScanMcscan32.dll
C:Archivos de ProgramaNorton AntiVirusViruscan.dat
C:progra~1 orton~1viruscan.dat
C:Archivos de ProgramaSymantecSymevnt.386
C:progra~1symantecsymevnt.386
C:PC-Cillin 95Scan32.dll
c:pc-cil~1*.dll
C:PC-Cillin 95Lpt$vpn.*
C:PC-Cillin 97Scan32.dll
C:PC-Cillin 97Lpt$vpn.*
C:TscPC-Cillin 97Scan32.dll
c: scpc-cil~1*.dll
C:TscPC-Cillin 97Lpt$vpn.*
C:TBAVW95Tbscan.sig
c:Tbavw95Tb*.*
C:Tbavw95Tbavw95.vxd
C:Archivos de ProgramaNorton Antivirus*.*

Home