Nazgul_II.2366
Description Nazgul_II.2366
It is a very dangerous memory resident parasitic polymorphic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. It has several errors and other corrupts files while infecting them and halt the system. It contains the text string:
[Nazgul]
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Dementia
Description Macro.Word.Dementia
This virus contains nine macros: AutoOpen, Dementia, FileOpen, FileSave, AutoClose, FileClose, FileSaveAs, ToolsMacro, FileTemplates. The infection routine is placed in the Dementia macro, all other macros call this macro when they are executed. As a result the virus replicates itself on opening, closing, saving and saving with new name. The virus does not manifest itself in any way.
Macro.Word.Demon
Description Macro.Word.Demon
It contains three macros, two of them have random selected names, the last one is AutoOpen in documents and AutoClose in NORMAL.DOT. To get these random names on infection the virus saves them in document's variables or in WIN.INI file.
To prevent duplicate infections the virus uses the description of the AutoClose macros. In infected files this description contains the string "Protects your computer". To detect itself the virus also creates the section "[I]" in WIN.INI file.
Starting from May and till December the virus removes itself from the system. It there is the text "Dark Master calling" in current document, and it is selected, the virus displays the MessageBox:
Microsoft WinWord DEMON
WINWORD HIDDEN DEMON
is happy to see his MASTER!!!
GREAT DAY !!!
This file is infected as # <¡«¼Ñ »« «½Ñ¡¿ >
|
Home
Viruses from A to Z
0-9
A
B
Ñ
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Z
|