Virus Database

Macro.Word97.Waterfall

Description Macro.Word97.Waterfall

This macro-virus contains two macros, "AutoOpen" and "autonomailer," in one module "waterfall," and replicates upon document opening.
The virus changes the Internet Explorer Startup URL with the new address: "http://www.kevinmitnick.com". The virus also looks for "Internet Mail" active, creates a new message to one of the addresses from the existing list, attaches an active (infected) document, and sends this message. The message Subject field contains the word "Hey," and the message body contains the strings:
Hey
Youve just got to read this!
Peace


Upon infection, the virus checks the current date and time, and in December, if the current time is 12 minutes past the hour, the virus appends to the AUTOEXEC.BAT file commands displaying the following message:
I have committed the sin of hacking and am unfit in the eyes of the Lord.
I confess to acts of witchcraft and art, dissidence and voodoo.
But in my Craft for which you condemn me,
I SURF THE BRAINWAVES OF GOD.

Check other viruses! Be aware! Use Antiviral Software

ScreenMixer.1072

Description ScreenMixer.1072

It is not a dangerous memory resident partly encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed or accessed by FCB FindFirst/Next DOS calls (DIR command). Depending on the system timer the virus mixes the letters on the screen.

Script.Inf

Description Script.Inf

This is a script virus that infects Windows INF files. These INF files contain the information that is used during installation a new software, or upgrading already installed programs. They are activated on entering the "Install" item in the context menu of Windows Explorer. To replicate itself the virus uses special script language that is used in the INF files.
When a software with infected INF file is installing, Windows looks for INF file in the package, opens it and processes instructions including virus script commands. The virus code when activated creates the VXER.TXT file, copies the host file to there and appends several DOS commands to the end of the AUTOEXEC.BAT file. On rebooting these commands search for first *.INF file in the WindowsInf directory on the current drive and overwrite it with virus code that was stored in the VXER.TXT file.

Home