Virus Database

No25.1744

Description No25.1744

These are not dangerous memory resident parasitic stealth viruses, "No25.1894" is encrypted. They hook INT 21h and write themselves to the end of COM and EXE files that are executed or closed. The viruses use anti-debugging tricks. Depending on their counters they display the message:
Made in No.25 middle school which lived in Beijing China.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Lulung

Description Macro.Word97.Lulung

The virus contains 23 macros. When an infected file is opened, the virus gains control, switches off the VirusProtection option and infects the global macros area. It also disables the Alt-F8 and Alt-F11 keys, disables and hides the "Visual Basic" toolbar and the "Tools/Macroall" menu. The virus infects other documents upon opening, closing, saving, saving with a new name and also upon exiting Word.
On July 26, it displays the following message box:
Today Is My Wife's Birthday. Happy Birthday Honey!

On February 8, it shows message box:
Today Is My Wedding's Day. Thank's God!

On June 8, and also upon several menu clicks, the virus shows a dialogue window with a photo of a child.
The virus code contains the following comments:
Welcome To My Listing Program !
Created and Programmed By. June 8, 1971
©April, 1998 - Ciputat
Sorry, If my program disturbs you !
It's not danger, I just want to be your friend !

Macro.Word97.Mamm

Description Macro.Word97.Mamm

This stealth macro virus contains one empty module "MAMM" and eighteen procedures in module "aviro": AstMaster, Mhapus, Mcopy, Action, FileOpen, AutoOpen, ViewVbCode, AutoExec, AutoExit, ToolsMacro, FileTemplates, FormatStyle, Refresh, AutoClose, FileExit, ToolsOptions, WBT, WBF.
It infects the global macros area on opening an infected document. The virus also creates in MS Word startup folder two infected files:
MAMM.dot
MAMM.src

On each document opening the virus checks all already opened documents and infects them. It also infects documents on their closing.
Starting from 15 May 1998 the virus activates its payload procedure. It sets its call on time 45 minutes after document opening. Payload procedure only displays the message box:
To: MAMM
If you delete this, you have no heart

The virus hooks menus "ToolsMacroMacrosall" and "ToolsMacroVisual Basic Editor". On click of these menus the virus displays "Record Macro" dialog box with macro description:
'If you delete this, you have no heart'

Home