Virus Database

Macro.Word97.Psd

Description Macro.Word97.Psd

This is the first known macro virus infecting Office2000 Word documents. It was discovered in December 1998. The virus uses the same methods of infection as Word/Word97 viruses use. The only difference is that the virus is converted into new Word document format and use few Office2000 specific instructions.
The virus affects the global macro area when an infected document is opened. The virus spreads itself into other documents when they are closed.
The virus disabled Word anti-virus protection by two ways: by using Basic instruction and by writing to corresponding filed in the system registry.
This is the stealth virus. While infecting the system it creates a stealth-macro that disables virus code viewing and exits Word without saving all changes.
The virus also uses polymorphic routine that randomly renames virus variables and subroutines names.
The virus code is places in one module in the Document_Open macro in infected documents. When an infected document is opened, the auto-macro Document_Open is executed by Word, the virus code takes control and installs the virus into the system. During that the virus copies its code to the global macros area with the Document_Close name and create additional stealth-macro ViewVBCode.
The virus checks the system date and time and in case current day number is equal to current minutes, the virus runs its trigger routine: it displays several figures of random size and random color.
The virus code contains the comment:
W97M/PSD by ALT-F11, VAMP Poly by VicodinES
Converted to W2000/PSD by VicodinES

Check other viruses! Be aware! Use Antiviral Software

Macro.Excel97.War

Description Macro.Excel97.War

This is Excel97 macro virus. It hooks sheets activation event and infects corresponding files. It also creates the infected file ALEVIRUSCS.XLM in the Excel startup directory and disables the Macro Virus Protection by running a short macro in a temporary MS Word application that is executed by the virus in hidden window.
The virus uses procedure from the "Macro.Excel97.Papa" virus to send own copies via e-mail, but in contrast to Papa virus it also infects other workbooks. So, when just infected workbook will be opened next time, this workbook (that may contain confidential information) will be sent to addresses stored in Outlook address book.
The e-mail message has:
Subject:
Fwd: Millions DEADS!!!
Body:
Urgent info inside. The III War is Begin!!! Read The Secret's in XLS!

To the message the infected workbook is attached.
After infection the virus creates the directories:
c:Arquivos de programasMicrosoft OfficeOfficeXLINICIO
c:Programs FilesMicrosoft OfficeOfficeXLINICIO

Latest closed document the virus saves in the "C:WINDOWS" folder with names WAR3.XLS, SEXO.XLS, FONE.XLS, AVP.XLS, CAIXA.XLS.
The virus also tries to replace default script of many popular IRC clients by own one which sends infected workbook to everybody joined to IRC channel.
On May 19th the virus shows office assistent balloon with message:
Aten§£o:
Primeiro Excel97>Email>MIRC> Virus Brasileiro by AlevirusSCS [Brasil]1999!
Em Breve Alevirus Excel97 Formula Virus!Mande-me Um EMAIL!
fernanda88@hotmail.com

The virus blocks Visual Basic Editor hot-key displays message box:
Este programa executou uma instrucao ilegal por favor feche o Windows
e reinicie.

Macro.Excel97.Xlscan

Description Macro.Excel97.Xlscan

It is a stealth Excel97 macro virus. It infects workbooks on their closing. While infecting the virus saves its code in sheets as "class" macros (see also "Macro.Word97.Class"). It also creates the infected MsOffice8.xls file in the Excel startup directory and disables the Macro Virus Protection by direct access to system registry.
Each time an infected document is being closed, the virus creates in the "C:WindowsSystem" folder several files with names generated using current date and time and extension ".INF"

Home