Virus Database

Macro.Word97.Reformasi

Description Macro.Word97.Reformasi

This is a stelth macro-virus. It infects the global macros area (NORMAL.DOT template) on infected document opening. Other documents get infected on their opening, closing and saving. While infecting a document, the virus adds the AutoCorrect entry to the document that replaces the text "yond" with a space character.
Before saving victim documents, the virus sets up hidden property for a whole text in a document and clears this property on document opening. As a result, in desinfected documents, the whole text will be invisible. One way to solve this problem is to check "View/Formatting marks/Hidden text [v]" checkbox in "Tools/Options" dialog box. Another way to make the text visible is do a commands click menu "Edit/Select All", then in "Format/Fontall" dialog box uncheck "Effects/Hidden [ ]" checkbox.
To hide itself, the virus disables the keys Alt+F11 and Alt+F8, blocks opening Visual Basic Editor, and ToolsMacro and Organaizer dialogue boxes.
The virus displays a non-standard dialogue on click "Help/About Microsoft Word"
Other two dialogs virus displays on choosing "File/Exit" menu if the day of the week is Friday.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Chandiga

Description Macro.Word.Chandiga

This virus contains only one macro AutoOpen and infects the global macro area and documents on file opening. The virus contains the text string:
This Code was written in Chandigarh (India) on 01.05.1996

Macro.Word.Chaos

Description Macro.Word.Chaos

This is the encrypted virus, it contains four macros:
in NORMAL.DOT in infected documents
FileOpen TempFileOpen
FileSave TempFileSave
AutoExec TempAutoExec
TempAutoOpen AutoOpen

On FileOpen or FileSave (file opening or saving) the virus writes its code to the file. On AutoOpen the virus installs itself into the system. In case of error displays the message:
Unexpected error! Error code -

On AutoExec the virus depending on system random counter either prints to status line the string "x/500", where "x" is a random number, or prints "500/500" and halts the computer.
The virus contains commented strings:
*********************************
* -x UlTiMaTe x- *
* CCCCC H H AAAAA OOOOO SSSSS *
* C H H A A O O S *
* C HHHHH AAAAA O O SSSSS *
* C H H A A O O S *
* CCCCC H H A A OOOOO SSSSS *
* -x v2.3 - 1st June, 1996 x- *
*********************************

Home