Virus Database

Pilgrim

Description Pilgrim

It's a not dangerous memory resident virus. It hooks INT 13h and infects the floppy Boot-sectors only. On 13th floppy infection it types a message in Russian.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Illiteral

Description Macro.Word.Illiteral

This is an encrypted Word macro virus. It contains three macros in documents and four macros in NORMAL.DOT: AutoOpen, Nod(AutoClose), Tiberium(FileTemplates, ToolsMacro).
The virus infects the global macros area (NORMAL.DOT) on opening an infected document and writes itself to documents that are closed.
On Sundays as well as on entering the Tools/Macro menu the virus sets the password for documents that depends on the current time. The virus then displays the DialogBoxes:
Brotherhood of NOD
User error !!, replace User !!
Enter new user name here:
If User name not fill, your data will be delete !
Brotherhood of NOD
Okay
We need to restart Word First

Then the virus writes the text to the C:WINDOWSNOD.INI file:
/----------------------------------------------------------|Virus name: Brotherhood Of NOD |
|Origin : Indonesia, Yogyakarta |
|Author : Foxz NoMercy Members |
|URL : http://www.geocities.com/ResearchTriangle/3996 |
----------------------------------------------------------/
Dear <User>,all
You was distrub this virus! please dont doit again
Password For <filename> = <password>
I'm fair !!, I let you know the password for
Your document. Peace!! and Unity!!
--><--><--><--><--><--><--><--><--><--><--><--><--><--><--

Macro.Word.Imposter

Description Macro.Word.Imposter

This is a plagiarism from "Word.Macro.Concept" and "Word.Macro.DMV". It contains two macros:
in infected document: AutoClose, DMV
in infected NORMAL.DOT: FileSaveAs, DMV

While infecting the system the virus receives the control in AutoClose document, renames DMV macro to FileSaveAs, then renames AutoClose to DMV. While infecting the files (FileSaveAs) the virus renames these macros back DMV -> AutoClose, FileSaveAs -> DMV.
While infecting the documents the virus displays the MessageBox:
DMV

One of the strings in the virus body looks like follows:
just to prove another point

Home