Virus Database

Mantra.719

Description Mantra.719

It is a very dangerous nonmemory resident parasitic virus. It searches for .COM files, then writes itself to the end of the file. Depending on the system time the virus tries to erase the disk sectors and displays the message, but fails and halts PC. The message is:
************************
* VALENTINE *
* HAS ENTERED! *
************************
This is the VALENTINE virus, 1.0 by Black Mantra

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Groovie

Description Macro.Word97.Groovie

This virus contains twenty macros in one module "Groovie": ID_Status, Install_Status, The_Groovie_Core, DocCodeCore, NormCodeCore, OrbitCoreCode, Groovie_Run, AutoOpen, AutoClose, AutoExit, FileSaveAs, filesave, fileclose, fileprint, IP_Love_You, mscript, viewvbcode, ToolsMacro, FileTemplates, Check_For_Doc.
The virus infects the system or documents when auto-macro is activated. It infects the system not only by infecting the NORMAL.DOT file, but also by creating the infected DATA.DOT file in the Word Startup directory. The DATA.DOT file contains module named ORBIT. While infecting the virus uses VBA export/import functions and save/read virus code to/from temporary C:GROOVIE.SYS file.
The virus deletes the menus "Tools/Macro" and "Tools/Templates and add-insall". On entering the ViewVBCode menu the virus displays the MessageBox:
ò ALT-F11 ò says...
It's GROOVIE

It also sets the "groovie" label on the C: drive. On Windows NT depending on the random number the virus tries to create machine IP configuration to the C:IP.TXT file and sends it to FTP server of FRISK International anti-virus company (F-PROT).

Macro.Word97.Horn

Description Macro.Word97.Horn

This virus contains two macros: AutoOpen, LittleHorn. The virus infects the system on opening an infected document. It infects the document on "e" keystroke - to do that the virus installs its infection macro LittleHorn as "e" keystroke handler.
The virus does not manifest itself in any way.

Home