Virus Database

Ordure

Description Ordure

It is a very dangerous memory resident polymorphic boot virus. While loading from infected disk it hooks INT 1Ch (timer), waits for DOS loading process, hooks INT 13h and then infects the MBR of the hard drive and boot sectors of floppy disks that are accessed. Depending on its random counters the virus erases data on hard drives.

Check other viruses! Be aware! Use Antiviral Software

Macro.Excel.Ultras.Cobra2

Description Macro.Excel.Ultras.Cobra2

This virus infects Excel worksheets. It contains one module "Sheet?" where '?' is '3' or '5' depending on the virus version. The "Sheet?" module contains auto-functions Auto_Open and Auto_Close. The virus module also contains the functions:
TIMER, Trojan
The virus infects the system and files upon opening and closing. It also creates an infected file in the Excel Startup directory, the file name is PERSONAL.XLS or PERSONAL.XLM depending on the virus version.
The viruses delete the Tools/Macro menu (stealth) and anti-virus programs:
C:Program FilesAntiViral Toolkit Pro*.*
C:Program FilesFindVirus*.*
C:f-macro*.*
C:Program FilesCommand SoftwareF-PROT95*.*
C:Program FilesMcAfeeVirusScan*.*
C:Program FilesNorton AntiVirus*.*
On the 4th of any month, the virus writes the commands that format the hard drive to the AUTOEXEC.BAT file . On the 14th of any month, it deletes the C:WINDOWSREGEDIT.EXE file and displays the MessageBox:
ULTRAS
You Infected XM.Trojan.COBRA by ULTRAS
On the 26th of any month, it displays the same MessageBox and deletes the files:
C:WINDOWSSYSTEM.DAT, C:WINDOWSSYSTEM.DA0.
The virus, depending on the current day, appends the instruction that formats the hard drive to the C:AUTOEXEC.BAT file.

Macro.Excel.Ultras.Freezer

Description Macro.Excel.Ultras.Freezer

This virus infects Excel worksheets. It contains one module "Sheet?" where '?' is '3' or '5' depending on the virus version. The "Sheet?" module contains auto-functions Auto_Open and Auto_Close. The virus module also contains the functions:
Joke
The virus infects the system and files upon opening and closing. It also creates an infected file in the Excel Startup directory, the file name is PERSONAL.XLS or PERSONAL.XLM depending on the virus version.
The viruses delete the Tools/Macro menu (stealth) and anti-virus programs:
C:Program FilesAntiViral Toolkit Pro*.*
C:Program FilesFindVirus*.*
C:f-macro*.*
C:Program FilesCommand SoftwareF-PROT95*.*
C:Program FilesMcAfeeVirusScan*.*
C:Program FilesNorton AntiVirus*.*
The virus displays the following MessageBox on the 14th of any month:
ULTRAS
You Infected XM.Freezer by ULTRAS
and deletes by DELTREE command all files in the C:PROGRA~1 directory. On the 28th of any month, it displays the MessageBox and deletes the files:
C:WINDOWSUSER.DAT
C:WINDOWSUSER.DA0

Home