Virus Database

Mirea Family

Description Mirea Family

These are harmless memory resident parasitic stealth viruses. "Mirea.1766,1773" are the polymorphic ones. They hook INT 9 (keyboard), 21h and write themselves to the end of COM and EXE files that are accessed. After 1000th keys entered via keyboard the viruses start to joke with keyboard buffer: they insert the text in Russian into this buffer. The viruses contain the text strings:
"Mirea.958": HELLO HACKERS FROM MIREA îêÉ¥Ç-II
"Mirea.1086": HELLO HACKERS FROM MIREA îêÉ¥Ç-III
"Mirea.1766": HELLO HACKERS FROM MIREA îêÉ¥Ç-IV
"Mirea.1773": POLYMORPHIC MIREA îêÉ¥Ç-VI
"Mirea.1813": POLYMORPHIC MIREA îêÉ¥Ç-VII

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Agent

Description Macro.Word.Agent

This is a polymorphic and stealth Word macro virus. It contains one macro "AutoOpen" and replicates on opening documents . The virus deletes the following menu items:
Tools/Macro, Tools/Customize, File/Templates, Format/Style.

The mutation (polymorphic) engine, depending on the random counter, inserts random comments into random positions into the virus code and renames some virus variables with random selected name. This engine is "slow" because it is executed only if, on infection, the current seconds are 23 or 45 only. As a result, in 97% of cases the polymorphic engine will not be executed and the "child" infector will have the same code as "parent" one.
Depending on the random counter the virus sends a copy of current document to Internet news-groups, so to spread itself the virus uses global networks. It also can be a reason of confident information disclosing, if it is a part of document that is sent to Internet.
To post documents to Internet the virus executed the news client AGENT.EXE, selects one of the news-groups (see the list below) and sends a message to there. The message has one of several possible Subjects (see the list below), the text "WM/Agent by Lord Natas" continued with random selected characters and attached infected document.
The list of news-groups looks like follows:
alt.aol-sucks alt.sex.zoophilia
alt.binaries.cracks alt.windows95
alt.binaries.pictures.erotica alt.sex.passwords
alt.binaries.warez.ibm-pc alt.binaries.warez
alt.conspiracy alt.binaries.sounds.mp3
alt.drugs.pot alt.comp.virus
alt.fan.hanson alt.2600
alt.flame alt.2600.hackerz
alt.hacker alt.skinheads
alt.sex alt.sex.babies
alt.sex.necrophilia alt.sex.bondage
alt.sex.stories

Subjects are:
Free XXX Passwords New Virus Alert!
Check this out! Serial Number List!
Official WaReZ site list Official mp3 site list
Easy Money! Elite XXX site list
My first fuck by Todd New erotic story
Hanson rulez! Important Princess Diana Info
Warez mailing list details Important Monica Lewinsky Info
Crackz mailing list details How to find child pornography
Learn to hack! Cable TV descrambler instructions!
Attn: All k3wl h4ck3rz Kewl N64 Emulator & MP3 sites
Important Info

Macro.Word.Akay

Description Macro.Word.Akay

This is an encrypted macro virus. The virus replicate on opening files (AutoOpen). It contains four original macros, that are copied to six macros during infections:
Documents NORMAL.DOT
Macro1 AutoExec AutoExec
AsliAutoExec AsliAutoExec
Macro2 FileOpenx FileOpen
Macro3 AutoOpen FileOpenx
AutoOpenx
Macro4 AntiMacrosVirus AntiMacrosVirus

While installing the virus searches for 42 macros of other viruses and deletes them. On each start the virus displays the MessageBox:
Created By Akay Inc.
Microsoft Anti-Virus Protection version 1.0

Home