Virus Database

BackTime.496

Description BackTime.496

This is a dangerous memory-resident virus. It hooks INT 8 (timer), and INT 21h and hits COM files by a standard way when they are executed.
This virus doesn't restore the registers when the INT 8 is called sometimes. It also contains the text "Joker".

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Cipher

Description Macro.Word97.Cipher
The virus contains seven macros in one module "Cipher": AutoNew, AutoOpen, AutoClose, cphrdoc, hideb, WindowsDirectory, and spreadIB. It replicates upon document creating, opening and closing (AutoNew, AutoOpen, AutoClose).
Depending on the system random counter, the virus sets the password "MisterCipher" on a current document or displays the following MessageBox:
Time Signal
I say to you that it's
It's too late. You must finish to work before next time!!!
Bye,Bye

On Friday the 17th, on the 31st of the month (excluding those with less days), and on the 25th of April, the virus drops a file infected by the the "Italian.578" DOS virus.
Upon closing documents on the 25th of April, or depending on the system random counter, the virus encrypts the text in the current document and displays the following MessageBox:
I want to say to you: L'Italia una ed indivisibile e c' la morte per
chi la divide!!!!!all..
Are you angry because you lost your document?+; Kill Bossi, the fault is his
Mister Cipher reigning

Macro.Word97.Clara

Description Macro.Word97.Clara

It is a polymorphic and stealth macro virus. It contains 8 macros in one module called "Clara": GetRandom, Effect, AutoOpen, AutoClose, ToolsMacro, ViewVBCode, ToolsCustomize, FileTemplates.
It infects the global macros area on opening an infected document (AutoOpen) and infects other documents on opening or saving (AutoOpen, AutoClose).
The virus turns off the Word virus protection (the VirusProtection option). It also disables the Tools/Macro, File/Templates, View/VBCode, Tools/Customize menus (stealth). The virus' polymorphic engine inserts random comments of random length into the virus code while infecting .
On the 1st of any month the virus displays a "Balloon" and MessageBox:
WM97.Clara
Author: Foxz/NoMercyVirusTeam
WM97.Clara
Thanks friends

The virus also contains the comments:
Thanks to Pyro
Thanks Chasm

Home