Virus Database

Nostardamus.5995

Description Nostardamus.5995

This is a very dangerous memory resident polymorphic parasitic virus. It hooks 21h and writes itself to the end of COM and EXE files that are accessed.
Depending on the system timer and its internal counters this virus also hooks INT 10h, or INT 16h, or INT 1Ch (depending on the virus version) and manifests itself by several effects: it corrupts the files, erases the disk sectors, changes the keystrokes that are entered, displays the message:
HOME RUN !!!
The viruses also display:
The NOSTARDAMUS.Maverick (CopyLeft) Version 3.2 ultra by Populizer
Formatting disk X: 40M
It also displays about 100 stupid messages in Russian and English:
Invalid user. Unknown error !
Good user - Dead user !!!
Insert new user and press ESC
I'm big RUSSIAN monstr !!
System error, invalid TC.EXE.
See you later all
Formatting disk C: y/y ?
Press CTRL-ALT-DEL ...
Crazy & Co. ltd.
Insert new baks into drive A:
(C) Porno C++ 3.1
(C) Trubo Pascacal 7.0
Virus detected, system halted

Check other viruses! Be aware! Use Antiviral Software

Macro.Office.Hopper

Description Macro.Office.Hopper

These are multi-platform macro-viruses infecting Office97 components: Word documents and Excel sheets. The viruses contain two auto-macros in Excel sheets and Word documents: Document_Close and Workbook_Deactivate.
The viruses replicate themselves in Excel upon deactivating workbooks. In Word, the viruses replicate upon document closing. The minor virus version spreads only from Excel to Word and not back, and the major virus version migrates from Word to Excel and back with no problems.
The viruses turn off the VirusProtection MS Office option. Depending on the version, the viruses contain the the following text comments or display them in MessageBox:
Ex-cell v0.1 /1nternal
Cross.BadSeed v0.1 /1nternal
Cross.BadSeed v0.2 /1nternal
Cross.BadSeed v0.3 /1nternal
Cross.BadSeed v0.4 /1nternal

Macro.Office.Jerk.b

Description Macro.Office.Jerk.b

This is a multi-platform macro-virus infecting Office97 components: Word documents and Excel workbooks and sheets. The virus contains two auto-macros in Excel sheets and Word documents: Document_Close in Word documents, and Workbook_Deactivate in case of Excel workbook or Worksheet_Deactivate in case of Excel sheet.
The virus replicates itself in Excel upon deactivating workbooks. In Word, the virus replicates upon document closing. Upon spreading, the virus infects not only "native" objects, but also exports its code to another Office component if it is installed in the system.
The virus turns off the VirusProtection MS Office option.
Each month from June to December on the 14th ,the virus displays the message:
www.all.net
V guvax <UserName> vf n ovt fghcvq wrex!

Home