Virus Database

Macro.Word97.Sparkle

Description Macro.Word97.Sparkle

This is a stealth macro-virus. It contains three modules and 11 functions:
"Sparkle" - FileSave, Toolsmacro, Filetemplates, Sparkle,
Toolsmacro, Filetemplates, ViewVbCode,
"userform999" - ListBox2_Click, UserForm_Initialize, CommandButton2_Click,
CommandButton5_Click, UserForm_Click,
"userform900" - CommandButton1_Click, CommandButton2_Click,
CommandButton3_Click, CommandButton4_Click,
CommandButton5_Click, CommandButton6_Click, ListBox2_Click,
ScrollBar1_Change, UserForm_Click.

On saving files (FileSave), the virus disables the VirusProtection, infects the global macros area and documents.
The virus draws its own dialogue on entering the Tools/Macro menu (stealth). On pressing any button (except "Cancel"), the virus displays the MessageBox:
Microsoft Word
This program has performed an illegal operation and will shut down.

Check other viruses! Be aware! Use Antiviral Software

Aga.3000

Description Aga.3000

It is not a dangerous nonmemory resident encrypted parasitic virus. It searches for COM and EXE files, then writes itself to the middle of the file. The virus uses anti-debug tricks. In some cases the virus hooks INT 13h and disables writing to the disks, manifests itself by some video effect, displays and prints the messages. The virus contains the text string:
Hello! You're already doomed!
WARNING!
It's AGA-v2 from MONGOLIA!
The file size was changed
[Q]uit or continue?
Try againall
DiRVeRWiNA: B: D: TiMeHeLpCaLcPaUsEWrItESeTuPDiR A:DiR B:Md
wArNiNg!FoRmAt A:/sDeL AuTo*.*DeL CoNf*.*Md ClEarHDMd
FoRmAtItscantiaidsdrweb.lkitf-pradinshercpav$$mon_k_pURAA!!!
Don't think about it!!!!!
Real-time error at 0x9207.
(*AGAv2.1,super stealth virus from MONGOLIA,UB -*)

Agena.723

Description Agena.723

It's a dangerous memory resident parasitic virus. It hooks INT 20h, 21h and writes itself to the end of COM- and EXE-files that are executed. Depending on the system date it erases disk sectors.

Home