Virus Database

Backdoor.TheThing

Description Backdoor.TheThing

This text was written by Peter Szor, Data Fellows Ltd
This backdoor copies itself with the EXPIORE.EXE name to the Windows directory and with the name of RUNDLI.EXE to the Windowssystem directory. It then modifies the SYSTEM.INI "shell" section to execute the program each time when Windows starts up, or the registry run field.
When executed, it tries to connect to wnp.icq.com with a user id of 111138. This id is owned by a hacker now calling himself "Of Hacker Anarchy Warrior". TheThing sends a message to him, and in this way, the hacker can see that the program is used on the actual machine. Then the local program starts to listen, therefore, the hacker can start to communicate and get information from that particular machine.
To remove it, someone has to delete this file and the RUNDLI.EXE from the system directory and fix the SYSTEM.INI shell section to remove the executed EXPIORE.EXE from there/or from the RUN field of the registry.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.FootPrint

Description Macro.Word97.FootPrint

The virus contains three macros in one module "ThisDocument": Document_Close, Document_New, Document_Open. The virus spreads on opening, creating or closing documents. While infecting it copies its code to all opened documents and templates.
The virus adds document file name to the primary footer in the first section of the infected document.

Macro.Word97.Frenzy

Description Macro.Word97.Frenzy

This macro virus contains one macro Frenzy. This macro contains auto-function AutoOpen and infects the system and documents on files opening.
The virus disables the AutoProtection. Depending on the system date and system random counter the virus displays the text:
Attention:
Word97.Frenzy by Pyro [VBB]

On random selected time the virus sets to current document the password "Frenzy". If the length of document is 25 symbols or above, the virus deletes random selected letter.

Home