Virus Database

Pempe family

Description Pempe family

These are not dangerous memory resident parasitic viruses, "Pempe.1943" encrypted. They trace INT 13h, 21h, hook INT 8, 21h and on disk access DOS calls search for .EXE files and write themselves to the end of the file. Depending on their counters the viruses decrypt and display the message:
+-----------------------------+
| P E M P E |
| AMACC (Makati,Phils) [PM] |
+-----------------------------+

The "Pempe.1811" virus also contains the text:
PEMPE 1.2

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Killuf family

Description Macro.Word.Killuf family

The viruses of this family contain three macros: AutoClose, VisioOpen, VisioClose. They spread on closing document (AutoClose). During infection they do not copy themselves to documents, but move. After copying they delete themselves in original document. They keep the name of current document in the WINWORD6.INI file in the [Microsoft Word] section with the name LUF01.
Starting from January 1st 1999 they erase the files on all drives in all directories: *.DOC, *.PPT, *.XL?, *.MPP, *.WPS, *.MDB. Then the MessageBox is displayed
HAPPY NEW YEAR FOLKS!

Macro.Word.Kilok.a

Description Macro.Word.Kilok.a

This is a family of Word macro viruses. They contain the macros:
"Kilok.a": AutoOpen
"Kilok.b": FileClose, NoMercy

In their macros the viruses do not have infection code "in clear" - the code there presents itself as encrypted text strings. To infect a document or NORMAL.DOT the viruses create a new macro, copy these strings to there, decrypt them and then execute. This new macro takes control and copies the code of original virus macro(s) to document or NORMAL.DOT.
"Kilok.b" contains the commented text:
--------------------------------------a Virus from NoMercy!!!
http://www.geocities.com/researchtriangle/3996
any critics, suggestions are welcome!
Yogyakarta, May/15/1997
-------------------------------------/

"Kilok.c,d" contains two macros in documents (AutoClose, NoMercy) and three macros in NORMAL.DOT (AutoClose, ToolsMacro, FileTemplate). These viruses contain the same text as "Kilok.b".

Home