Virus Database

NoWin.2576

Description NoWin.2576

It is not a dangerous memory resident parasitic encrypted virus. It hooks INT 9, 21h and writes itself to the beginning of COM and to the end of EXE files that are executed or closed. When an infected file is opened, the virus disinfects it. While executing WIN.* file the virus reboots the computer. In some cases the virus beeps by PC speaker. The virus contains the text strings:
Copyright (c) 1993-94 XY, Zielona G¢ra.
R_H
|PL|

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Atom

Description Macro.Word.Atom

These viruses contain four macros: Atom, AutoOpen, FileOpen, FileSaveAs, and infects Word while loading an infected document (AutoOpen).
The viruses infect files in two ways: while opening a file (command File/Open, macro FileOpen), and while saving a document with new name (command File/SaveAs, macro FileSaveAs).
While infecting a document while saving it with new name (FileSaveAs) the virus checks the system time. If the value of seconds is equal to 13 the virus set the password ATOM#1 for this document. The virus cannot set the password if the file is already infected - Word displays the WordBasic error message.
While opening an infected document on 13th of December the virus deletes all files in the current directory. It seems that the system has to display the error message while deleting opened files.
"Atom.a"-related macro viruses differ from "Atom.a" only by placing their WordBasic text strings in virus source code. "Atom.g" is "Atom.a", translated to German - it contains macros: Atom, AutoOpen, DateiÖffnen, DateiSpeichernUnter.

Macro.Word.Attack

Description Macro.Word.Attack

This is an encrypted macro virus. It contains eight macros: Attack, AutoOpen, FileSaveAs, FileOpen, InActive, Active, ToolsMacro, Organizer. It infects the global macros area on AutoOpen call and writes itself to the documents on FileOpen and FileSaveAs calls.
To hide its code the virus disables the ToolsMacro and Organizer menus. Depending on the system random counter the virus either sets the Hidden attribute for current file or inserts the strings into document:
This is The Microsoft Bang! ** Virus** ---

Home