Virus Database

Ninja.1225

Description Ninja.1225

These are very dangerous memory resident parasitic viruses. They hook INT 21h and infect COM and EXE files except COMMAND.COM and AIDSTEST.EXE. Before and after infecting a file the viruses write to the end of the file blocks of random data of random length (from 0 till 255 bytes), the result looks as follows:
+------+------+---------+---+
|File |XXXXXX|Virus |XXX|
+------+------+---------+---+

Sometimes the viruses overwrite the files with a small program that decrypts and displays the message:
"Ninja.1336":
DZINA VIRUS v 4.0 Copyright (C) 1990,91,97 Dzina Corp

"Ninja.1370,1376":
Mutant Ninja Version 2.0 Copyright (C) 1990,91 Virus&Worm Software

In 1992 on 13th of any month the viruses erase the FAT of C: drive. They also contain the texts:
COMMAND.COM AIDSTEST.EXE .COM .EXE

Ninja.Craz
It fails to detect itself in already infected files, and affects them two and more times. Depending on the system date and time it plays a tune, corrupts the files, erases the disk sectors and reboots the computer. It contains the text:
Mutant VIRUS Copyright (C) 1996,97 Craz Software

Ninja.Raving
These are harmless viruses. These viruses infect the same EXE file two and more times. "Raving.1195" contains the text:
It's a beautiful life!
Can't stop raving

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Vicissitator

Description Macro.Word.Vicissitator

This is a polymorphic Word macro virus. It contains only one macro in infected documents - FileSave, but while infecting the system it creates two macros - FileSave and ToolsMacro (stealth). The virus replicates itself when documents are saved (FileSave). While infecting the virus creates the Vicissitator macro, copies its code to there and edits it (polymorphic engine). The virus then copies to the document the result macro with name FileSave.
While infecting NORMAL.DOT the virus writes the text to the ToolsMacro macro:
You have been Infected by the Vicissitator Macro Virus.
(C)1997 CyberYoda A Member of the SLAM Virus Team

Macro.Word.VisuaLand

Description Macro.Word.VisuaLand

This is an encrypted Word macro virus. It contains five macros: AutoOpen, FileOpen, MyMessage, VisuaLand, FileSaveAs.
The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are saved (FileSave). The virus also attempts to infect files that are saved with new name (FileSaveAs), but fails because of an error.
On 13th of any month it erases all files in current directory and displays the MessageBox:
VisuaLand!
VisuaLand Technology is the BEST!

On saving a document with new name, if current seconds = 13, the virus sets the password: "VisuaLand". The virus creates the MESSAGE.TXT file and writes the text to there:
VisuaLand 2.0 Oleh: Milky Wahyudi
Widjaya GoldSecret (C) 1997 VisuaLand Technology
Virus kedua setelah visuaLand 1.0 (rekayasa Concept)
Seperti biasanya saya selalu hadir kedepan anda untuk
selamat, untuk segala sesuatu yang telah anda lakukan
memang enak menjadi orang seperti anda, tapi jangan
dikira anda ini sedang 'happy', anda rupaya sedang
mengalami masa-masa krisis pada komputer anda, jangan
menuduh teman anda atau pacar anda yang melakukan hal
ini, tetapi itu merupakan ulah saya.
Virus ini merupakan hasil rekayasa virus Atom, yang
dulunya saya akui bahwa virus tersebut merupakan saya
yang buat, tetapi banyak orang sirik yang ingin merebut
nya dari saya, tetapi sayalah yang membuat Atom, versi
ini merupakan versi perbaikan dari virus Atom"
Bila anda ada waktu senggang, anda bisa menemukan saya
di rumah pada jam-jam tertentu, saya harapkan hubungan
dari anda.
Milky Wahyudi Widjaya
Jl. H Marzuki No. 37 RT 6/3
Jakarta - 11530
Indonesia
+62 21 5320382
EMail: milky@dnet.net.id
milky@visualand.com
HPage: http://www.visualand.com/

The virus also contains the comments:
----------------------------------------------------------------
Virus: VisuaLand.2.WinWord
Author: Milky Wahyudi Widjaya
VRating: Make First WordMacro.virii (Atom)
Compiler: WordMacro in ToolsMacro
(C) 1983-1994 Microsoft Corporation
Copyright: GoldSecret (C) 1997 VisuaLand Technolgy
Email: milky@dnet.net.id 'or' milky@visualand.com
Homepage: http://www.visualand.com/
Last Update: 02-02-1997
VL Office: Visualand Technology
Jl. H. Marzuki No.37, RT 06/03
Jakarta, 11530
Indonesia
Phone: +62 21 5320382
Dedication: - Unknown (Atom was created by you???)
- Eko Sulistiono (MD)
- All VirMarker in the World
Thank's: God
-----------------------------------------------------------------

Home