Virus Database

Macro.Word97.Model

Description Macro.Word97.Model

The virus code contains five macros in one module "Code": AutoOpen, AutoNew, CopyVirCodeToModel, CopyVirCodeToDocument, RemoveProtection.
On opening an infected document the virus infects the global macros area. The virus infects documents on their creating or saving. The virus does not manifest itself in any way.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.BadBoy.a

Description Macro.Word.BadBoy.a

This is an encrypted virus, it contains five macros: AutoOpen, FileSaveAs, BadBoy, AutoExec, FileNew. The virus infects the system on AutoOpen and writes itself to files on FileSaveAs.
While infecting a document the virus also sets new FileSummaryInfo:
Author = "Kenny-G sux"
Keywords = "Gangsta Rappa"
Comments = "The Mutha mix"

On AutoOpen, if the system is already infected and current day is 1st or 13th, the virus displays the message boxes:
Mack daddy
Bad Boy, Bad Boy, What u gonna do
the Gangsta Rappa
What u gonna do when they come for you
BMF
The Gangsta owns you !
BMF
Have a happy new year !

Then it sets the password for current document: "gangsta".
To hide itself in the system the virus on FileNew, AutoExec and AutoOpen removes the menus Tools/Macro, Tools/Customize, File/Templates.

Macro.Word.Balrog.a

Description Macro.Word.Balrog.a

This is the encrypted macro virus. It contains only one macros "AutoClose" and infects the global macros area and documents on File/Close call. This is a Spain-specific macro virus - it does work only under Spain-Word version. Under other versions it overwrites the C:COMMAND.COM file with a copy of the current document.
Depending on a random counter it appends the text to the end of current document:
P.S.: You are a very stupid people.
P.S.: I hate you a lot.
P.S.: I wish your death.
P.S.: All the things I told you are lies.
P.S.: Call me if you need sex.

Home