Virus Database

Necros.1164

Description Necros.1164

It is not a dangerous memory resident polymorphic virus. It hooks INT 1Ch, 21h and infects COM and EXE files. This virus writes itself to the beginning of the COM files, and infects EXE files in companion way: the virus creates the .COM file with the name of .EXE file.
On November, 21th the virus beeps and displays:
Virus V2.0 (c) 1991 Necros The Hacker.
Written on 29,30 June in Tralee, Co. Kerry, Ireland.
Happy Birthday, Necros!

It also contains the text:
Virus V2.0 [FrIEND]

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Prizm

Description Macro.Word.Prizm

This is an encrypted Word macro-virus. It contains nine macros: PRiZM, AutoExec, AutoOpen, FileOpen, FileSave, FilePrint, FileSaveAs, ToolsMacro, and FileTemplates.
It is based on the "Word.Cap" virus, has a similar structure and instructions set. It replicates upon document opening, closing, and saving.
While printing, the virus appends a string to the end of the document that is printed:
Battle of life. Capital!!!

The virus has an unusual method of infection. While infecting, the virus performs several steps, uses the system registry, and drops an additional EXE file. The infection routine is placed in the virus' code as a set of text strings that are DDE (Dynamic Data Exchange) instructions. If needed, the virus executes them, and these instructions copy the virus' code to target the documents and templates.
To execute its DDE instructions, the virus saves them to the system registry in the "HKEY_CLASSES_ROOT###fileshellopenddeexec". The virus then registers a new extension "###", and sets DDEEXEC as a handler of files with such an extension.
The virus then creates a randomly named EXE file in the Windows temporary directory, and writes a short program into it. This program only creates and opens the "PRiZM.###" file. This file-name extension is linked with DDEEXEC, and as a result, Windows activates the virus, DDE instructions, executes them and they copy the virus code to a victim file.

Macro.Word.Puritan

Description Macro.Word.Puritan

This is a dangerous macro virus. In infects documents and global macros area (NORMAL.DOT). There are six virus macros, but there are only five different ones:
Document NORMAL.DOT
Macro1 Puritan Puritan
Macro2 Rtr Retro
Macro3 FSAB FileSaveAs
FSAB
Macro4 AOB AOB
AutoOpen
Macro5 ToolsMacro ToolsMacro

The virus infects global macros area on AutoOpen and documents on FileSaveAs. The virus deletes the anti-virus files, if they exist:
C:Program FilesNorton AntiVirusVirscan.Dat
C:Program FilesF-Prot95Fpwm32.dll
C:Program FilesMcAfeeScan.dat
C:Tbavw95Tbscan.sig

It also appends to the end of AUTOEXEC.BAT file the commands that also delete these files:
@echo off
IF exist C:Program FilesNorton AntiVirusVirscan.Dat
then del C:Program FilesNorton AntiVirusVirscan.Dat
IF exist C:Program FilesF-Prot95Fpwm32.dll
then del C:Program FilesF-Prot95Fpwm32.dll
IF exist C:Program FilesMcAfeeScan.dat
then del C:Program FilesMcAfeeScan.dat
IF exist C:Tbavw95Tbscan.sig
then del C:Tbavw95Tbscan.sig

On accessing Tools/Macro menu the virus displays the MessageBox with the strings:
Out of memory.
WordBasic Err = 7

The virus contains the comments in the Puritan macro:
The Style of macro virii was invented by
those with an Open mindall
If you have an Open mind To other influences
you will grow out as one of the best...
'Poet of the highest quality ;-) from
'--- Neophyte ----

Home