Virus Database

Nuke.Awake.600.a

Description Nuke.Awake.600.a

These are non-memory resident encrypted parasitic viruses. They search for COM files, and write themselves to the end of the file. They contain the strings:
"Nuke.Awake":
<< AWAKE! >> John Will Die Some Day! TheN HaTs Off to HiM-AWAKE!
WE ALL GET OLD AND DIE! DeathBoy will be the DEATH-of John someday!
He told me he is fooling him
NuKE/ARIS/VA/SUKZ/BaD/CoDE -COPY-WRITE 1994 MuTaTiON_INTERRUPT-

"Nuke.Jak.991":
Jak EMP
Pentiums Suck!
Enjoyment to those who ignore!

"Nuke.Sirius.402":
<< Ebbelwoi >> by (-)SRUS 10-93 D-63225

Nuke.1680
This is a dangerous non-memory resident parasitic virus. It searches for .COM files (except COMMAND.COM), and writes itself to the beginning of the file. Sometimes it erases the disk sectors. It contains the text strings:
*.COM COMMANDE
Virus Created by NuKE- GenVirus V1.51 Licence n ƒid# [NuKE]-93ƒ

Nuke.Bob
This is a benign virus. It leaves a small TSR-program that displays:
Bob Ross lives!
Bob Ross is watching!
Maybe he lives hereall
What a happy little cloud!
Maybe he has a neighbour right here...
You can make up stories as you go along.Never Believe!

Nuke.Clock
In March, it formats disk sectors. On Mondays, it leaves a small TSR program that hooks INT 08h (timer) and sometimes summons INT 1Ah (system clock functions) with the random parameters.
Nuke.DC00L.1811
This virus leaves a memory resident program that hooks INT 08h and displays:
SHALOMKnock... Guess who's There...
Fuck Asi Azulay and Lior Cohen ...
It's Dr. Unknown... :-)
Fuck Guy Assado for Distributing my Sources...
Use XOPEN, MAN!!! FUCK Stick-Buster!!!
ViSiON-X is Some C00L Program !!!
Call to Support board: +972-X-XXXXXX !!!
TNTVIRUS is SHIT!!! Cpav is SHIT!!! Use McAfee!
But... McAfee is SHIT too...
Borland is the BEST...
Too bad, you didn't make Backup for your HD... :)
I Wonder, What INT 13h Does with AH=05...
Just kiddin'... Ya know?
GUY ASSADO IS MONGOL!!!
COOLNESS is FOREVER!!!

It also contains the string:
D-C00L-1 ViRUS

Nuke.Deadpool
Sometimes it displays:
Deadpool by Phalcon/Skism

Nuke.Elvis
Sometimes it hooks INT 8 (timer), stays memory resident and displays the messages:
ELVIS lives!
ELVIS is watching!
Don Maybe he lives here...
Is he really dead? Or Here?
Maybe he has a neighbour next door...
You can make up stories as you go along.
(C)1991 Elvis/VFriend, INC. All rights reserved.
Congratulations, you are now infected with the Elvis Virus.

Nuke.Howard.967
This is a benign non-memory resident parasitic virus. It searches for .COM files, and writes itself to the end of the file. It blinks with NumLock/CapsLock/ScrollLock indicators, and contains/displays the text strings:
I'm not working until Howard Stern is done @ 11:00 am !
Bow down before the King
Smile ... [NuKE] loves you
I'm not working until Howard Stern is done @ 11:00 am !
1234567890!@#$%^&*()ascii
(c) Ba Ba Stupid...
Remember Studderin' John Robin, I love You! Long Live [NuKE]
Georgia needs Howard Stern

Nuke.LoneWolf.867
Overwrites the files with the string:
[Lone Wolf] 1993 KillRaven - Independant

Nuke.Marauder.a and b
These are dangerous viruses. On February 2nd, they write the command INT 20h to files (return to DOS). They contain the text:
[Marauder] 1992 Hellraiser - Phalcon/Skism...

Nuke.Ministry
This is a benign virus. It leaves a small TSR-program that displays:
I Get a Flashback!
I'm Burning Inside!
Breathe You Fucker!
Jesus Built My Hotrod!
Everyday is Halloween!
The Ministry Virus - Written by NegativX - (c) 1991 -SiTT-

Nuke.Nuke5 and Nuke.Testing
These are harmless viruses. They hook INT 21h, and write themselves to the end of COM and EXE files that are executed. They contain the text strings:
"Nuke.Nuke5.478": [PS/G] NuKe [NukE5]
"Nuke.Testing.438": [PS/G] Testing [G2 A]

Nuke.Pox.630
This is a benign memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of COM files that are executed. Depending on the system time it decrypts and displays the following messages:
It's past 9pm. Get off the computer and go to bed!!!
And remeber this would not have been possible if there
weren't any Youngsters Against McAfee
Admiral bailey [YAM]

Nuke.Pox.609,955,963
These are dangerous memory resident encrypted parasitic viruses. They hook INT 9 and 21h, and write themselves to the end of COM and EXE files ("Npox.609" infects COM files only) that are executed. On the 24th of any month when the 'S' key is preseed, these viruses format the hard drive sectors. The viruses contain the text strings:
"Nuke.Pox.609": Rock Steady/NuKE
"Nuke.Pox.955": NukE PoX V1.1 - R.S
"Nuke.Pox.963.a": Evil Genius V2.0 - R.S/NuKEC:COMMAND.COM
"Nuke.Pox.963.?": (c) 1992 by Igor Ratzkopf - All Rights Reserved July R

Nuke.Pox.1482,1686,1708,1722,1800,1844
These are memory resident parasitic stealth viruses. They hook INT 21h, and infect the COM and EXE files that are executed or closed. The EXE files may be infected in an incorrect way; they halt the computer being executed. When an infected file is opened, the viruses disinfect it. The viruses contain the text strings:
"Nuke.Pox.1686": NuKE PoX V2.1 - Rock Steady
"Nuke.Pox.1800": NuKE PoX V2.0 - Rock Steady
"Nuke.Pox.1844": Death by Miscgenation DIE WHITE GOYIM DIE! '94(c) IsRaEl

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Temple

Description Macro.Word.Temple

This macro virus contains four macros that have different names in documents and NORMAL.DOT:
Documents NORMAL.DOT
TempAutoExec AutoExec
TempFileSave FileSave
TempFileOpen FileOpen
AutoOpen TempAutoOpen

While loading an infected document (AutoOpen) the virus infects the global macros area (NORMAL.DOT). On saving or opening a file (FileSave, FileOpen) the virus infects the current document.
The virus does not manifest itself in any way.

Macro.Word.Tenfaces

Description Macro.Word.Tenfaces

This is an encrypted macro virus. It contains three original macros, but while infecting it copies it with 8 different names to global macros area and with 4 names to documents. While copying the virus selects random name to hide its macros:
Documents NORMAL.DOT
Macro1: AutoOpen xxxxxLove
xxxxxLove
Macro2: xxxxxAnik xxxxxAnik
FileClose
Macro3: xxxxx1109 xxxxx1109
ToolsMacro
Organizer
ToolsCustomize
FileTemplates

where "xxxxx" are random strings.
The virus infects the system on AutoOpen call and writes itself to files on AutoClose. Macro3 is a payload macro and it disables Tools/Macro, Tools/Customize and File/Templates menus as well as Organizer. On these calls the virus displays the MessageBox:
Microsoft Word
You try to Kill meallhah!, I beat your Keyboard!

It then changes the keyboard layout.
The virus also creates new variables in system profiles (WIN.INI file) in [Intl] section:
Code_Name=WORDMACRO.TENFACES
Creator=Creator of NoMercy!
Dedicated=My Love, Anik AY

Home