Virus Database

Macro.Word97.Wnw

Description Macro.Word97.Wnw

This macro virus contains seven macros and functions in single module "WNW": AutoExec, AutoOpen, FileSaveAs, WNWP, FileTemplates, ToolsMacro, ViewVBCode. The virus infects the global macros area on opening an infected document. Other documents get infected on opening or saving with a new name.
On Saturdays and Sundays, the virus displays the warning messages:
On est Samedi, aujourd'hui
Je ne travaillerai pasall
On est Dimanche, aujourd'hui
Je ne travaillerai pas...

Depending on the number of such messages, the virus performs several destructive operations (see below). The counter of these messages is stored in the WINWORD8.INI file in the [WNW] section in the Total item.
On the 10th message, the virus displays the MessageBox:
Virus WNW
Vous jouez avec le feu...

and deletes the files: C:WINDOWSBUREAU*.LNK and C:WINDOWSMENU DãMARRER*.*
On the 20th message, the virus displays the MessageBox:
Virus WNW
Je vous avais prÊvenu...

and deletes the files:
C:Windows*.ini
C:Autoexec.bat
C:Config.sys
C:Msdos.sys
C:Io.sys

On the 30th message, the virus displays the MessageBox:
Virus WNW
Vous l'aurez voulu!!!!

and formats the C: drive.
On these days, the virus, depending on the system random counter, also either displays the MessageBox:
Virus WNW
Au revoir...

or draws the text in the header line of Word window:
Je ne veux pas travailler ce weekend, donc, je vais vous en empËcher...

Check other viruses! Be aware! Use Antiviral Software

Poss Family

Description Poss Family

There are memory resident dangerous parasitic viruses. They hook INT 8, 21h and write themselves to the end of COM and EXE files (except COMMAND.COM). Sometimes they delete the files. They manifest themselves by the face picture which is drawn on the screen. They also contain the text strings:
COMMAND.COM
POSSESSED! Bwa! ha! ha! ha! ha!
Author: JonJon Gumba of AdU
:*.COM :*.EXE

Potpis.696

Description Potpis.696

It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of .COM files that are executed. On May 1st the virus displays the message:
Matija Papec 4.k Maturalna radnja 1994.

The virus also contains the text:
Potpis

Home