Virus Database

Net-Worm.Win32.Nanspy.d

Description Net-Worm.Win32.Nanspy.d
This network worm infects computers running Windows. The worm itself is a PE EXE file approximately 34KB in size, packed using UPX. The unpacked file is approximately 103KB in size. The worm propagates via the RPC DCOM vulnerability detailed in Microsoft Security Bulletingall

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Coe

Description Macro.Word.Coe

This macro virus contains three macros with random selected names - while infecting the virus selects three random names and copies current macros with these new names. To get these names on next infection the virus saves them in internal document's variables or in Windows WIN.INI file in section [Intl] in stings: "Info1=", "Info2=", "Info3=".
The virus does not contain any auto-name, so it cannot replicate itself in most of the cases. It replicates only if random selected name is the name of some auto-function (the probability is very closed to zero), or if some virus macro is executed by user (Tools/Macro/Run).

Macro.Word.Color (Rainbow, Color Changer)

Description Macro.Word.Color (Rainbow, Color Changer)

This is encrypted virus, it contains the macros:
macros, FileNew, AutoExec, AutoOpen, FileExit,
FileSave, AutoClose, FileSaveAs, ToolsMacro

This virus infects the files while creating of new document (FileNew) and while saving the document with new name (FileSaveAs).
On each 300th call to the file functions (FileNew, AutoOpen, FileExit, FileSave, AutoClose, FileSaveAs and ToolsMacro) the virus alters the section [colors] in the WIN.INI file, and sets the random selected colors for Windows components. New colors appear after next Windows loading. The virus keeps the trigger counter in the WIN.INI file in the [windows] section:
[windows]
countersu= 234

The virus allows executing of Auto-macros (AutoOpen, AutoClose and so on), it sets DisableAutoMacros to zero.
When the virus is active, it is impossible to activate Tools/Macro command. To manual disinfection it is necessary to delete virus' macros by using Organizer (Tools/Customize, Word command, then draw Organizer out to toolbar).

Home