Virus Database

Macro.Word97.Vampire

Description Macro.Word97.Vampire

This virus contains 13 macros in one module: AutoOpen, autoexec, AutoClose, FileTemplates, KZ, pire, ToolsMacro (stealth), Vampire2, VM, VM1, VM2, VM3, VMP.
It replicates itself on opening and closing documents (AutoOpen, AutoClose). When an infected Word97 is starting, the virus, depending on the random counter, scans the C: and D: drives and beeps when each file is found. The virus then displays a dialogue box in Chinese. Depending on the system time, the virus inserts a text in Chinese in the current document.
On entering the Tools/Macro menu, the virus displays the MessageBox:
Microsoft Visual Basic
Out of Memory

Check other viruses! Be aware! Use Antiviral Software

Konkoor.1933

Description Konkoor.1933

This is a dangerous memory resident parasitic virus. While executing an infected program, this virus searches for the DOS address in the INT 21h handler, then searches for COM files, and hits them. Then the virus hooks INT 21h, and intercepts the FindFirst function (AH=4Eh). During calls to that function, the virus searches and infects COM files and also upon the execution of an infected program. While infecting, the virus writes itself to the beginning of the files, and encrypts the host file. On the 100th infection, or depending on the system date, it erases CMOS and hard drive sectors, and displays the following messages:
Warning !!! KONKOOR Must be destroyed !
Sig: -= The Real Computer Scientists =-
and
KONKOOR V1.60 -- Date: 10 MARCH 1994
While installing, it also displays the message:
Bad command or file name

Konkoor.3072

Description Konkoor.3072

This is a very dangerous memory resident parasitic virus. It hooks INT 21h, intercepts the DOS function ChangeDir (AH=3Bh), and when that function is executed, the virus searches for EXE-files, and writes itself to the middle of the file. The virus has a memory allocation error, and may halt the system while infecting the files. The virus checks the file names for the text string, and does not infect these files:
SCAN
CLEAN
VSHIELD
FINDVIRU
FV386
FV86
CLEANBOO
VIVERIFY
CERT
MSAV
GUARD
TDUMP
Under DOS 4.x or earlier, the virus displays the following message, and returns to DOS:
Incorrect DOS version
On the 13th of any month, the virus overwrites the hard-drive MBR with a trigger program. While booting from this MBR, the program displays the following message:
Konkoor v2.0 - Crack Master - Last Days Of 1995
What Was The First Iranian Virus ?
1. Abbas ??? (Was it Iranian ?)
2. Roohi
3. TDD - Konkoor v1.0
4. None Of Above
-= This is The Last One If You Solve Copyright Problem =-
Choose the correct answerall
waits for key '3', and continues booting.

Home