Virus Database

Macro.Word97.Dreams.a

Description Macro.Word97.Dreams.a

This virus contains five functions in one module "Dream": AutoOpen, FileOpen, FileNew, FilePrint, FileExit. The virus replicates itself on any function activating, i.e. on documents opening, creating or printing. To copy its code the virus uses export/import functions via the temporary C:CONFI~1.~YS file.
On Word exiting the virus depending on the system random counter saves the current document with one of the names: HARDCORE.DOC, HEROINKILLS.DOC, LESBIANS.DOC, DESIRE.DOC, GRAVITYKILLS.DOC, R.I.P-TALON.DOC, HOPE.DOC. Depending on the system date it saves it either on the M: drive (before 15th of month) or on the F: drive (starting from 15th).
The virus erases the menu items "Tools/Macro" and "Tools/Templates and add-insall". On 21st of any month it creates the C:WINDOWSDREAMS.TXT file and writes the text to there:
.-=BadDReAms=-.
When you sleep
Do you see an angel in the dying light
Or can you see someone standing outside
Trying to set you alight.
Maybe you`ve seen Someone Somewhere before
That I might have loved had I never loved you
But you only see Me In bad dreams

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Chandiga

Description Macro.Word.Chandiga

This virus contains only one macro AutoOpen and infects the global macro area and documents on file opening. The virus contains the text string:
This Code was written in Chandigarh (India) on 01.05.1996

Macro.Word.Chaos

Description Macro.Word.Chaos

This is the encrypted virus, it contains four macros:
in NORMAL.DOT in infected documents
FileOpen TempFileOpen
FileSave TempFileSave
AutoExec TempAutoExec
TempAutoOpen AutoOpen

On FileOpen or FileSave (file opening or saving) the virus writes its code to the file. On AutoOpen the virus installs itself into the system. In case of error displays the message:
Unexpected error! Error code -

On AutoExec the virus depending on system random counter either prints to status line the string "x/500", where "x" is a random number, or prints "500/500" and halts the computer.
The virus contains commented strings:
*********************************
* -x UlTiMaTe x- *
* CCCCC H H AAAAA OOOOO SSSSS *
* C H H A A O O S *
* C HHHHH AAAAA O O SSSSS *
* C H H A A O O S *
* CCCCC H H A A OOOOO SSSSS *
* -x v2.3 - 1st June, 1996 x- *
*********************************

Home