Virus Database

Permutan.544

Description Permutan.544

It is a very dangerous memory resident parasitic virus. It hooks INT 13h, 20h and stays memory resident. While installing into the memory the virus leaves in the system memory its own code as well as the code of host file.
On INT 20h calls (Terminate) the virus gets from PSP the file name of active program and writes itself to the end of the file.
Depending on the system timer the virus corrupts the data that is saved on disk (INT 13h). The virus contains the text string:
Permutan

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Niki

Description Macro.Word.Niki

This encrypted virus contains six macros: AutoExec, AutoOpen, FileApri, FileSalvaConNome, StrumMacro, NiKI. The virus infects the global area on AutoOpen and writes itself to the documents on FileApri (FileOpen?) and on FileSalvaConNome (FileSaveAs?).
The virus in some way modifies the Tools/Customize menu. Depending on the system time it runs its trigger routine (macro NiKi) that in some way modifies the current document and deletes *.DOC and *.DLL files in C:MSOFFICE and C:WINDOWSSYSTEM directories.

Macro.Word.Niknat.i

Description Macro.Word.Niknat.i

This encrypted macro virus contains four macros, it replicates on closing documents (AutoClose):
Documents NORMAL.DOT
EvaHzg EvaHzg
AutoClose DCloseAN
FileTemplates FileTemplates, ToolsMacro
TCloseAN AutoClose

On October 23 the virus creates the EVAH.BMP file with a porno-picture image inside in the Windows directory and sets it as the Windows background picture (wallpaper). The virus then also changes Windows color palette.
On entering the File/Templates and Tools/Macro Word menus the virus displays the MessageBox (stealth):
Microsoft Windows
Windows Protection Errorr

The virus also contains the comments, these comments depend on the virus version:
"Niknat.a,b,all":
by NAENBGOURSG
SO.HT.AI.KS
231076-GREECE
Thanks to NEURO
VRD 19-4-1997
VRP A.U.A (+.+.+)

"Niknat.i":
--------------------------------
Latin word -virus- means poison and is a derivative
of two Sanskritic roots --> -vishas->(poison)
and -ishus->(arrow).
NAENBGOURSG - SO.HT.AI.KS
M.SC. in MacroViral Science
---------------------------------

Home