Protect Family
Description Protect Family
These are dangerous memory resident parasitic viruses. They hook INT 21h and 1Ch or 33h depending on their versions, and then write themselves to the end of COM and EXE files that are executed.
"Protect.1157,1196" clear the file attributes and corrupt the mouse driver
(in the memory). "Protect.1355" manifests itself by a small and very
disgusting screen trembling.
The viruses contain the text:
File protection
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Naen
Description Macro.Word.Naen
This is an encrypted virus that contains four macros: OemLogo, FileTemplates, AutoOpen (MeoClose in NORMAL.DOT), OemClose (AutoClose in NORMAL.DOT).
The virus infects the global area on AutoOpen and writes itself to the documents on AutoClose. On entering File/Templates menu the virus displays the MessageBox:
Microsoft Windoze
Windoze Frotection Error
The virus creates the C:WINDOWSSYSTEMOEMINFO.INI file and writes the text to there:
[general]
Manufacturer=NAENBGOURSG
Model=209711 - SO.HT.AI.KS
The virus then creates the C:WINDOWSSYSTEMOEML.NIK file and writes to there a hexadecimal dump of OEMLOGO.BMP, then creates the C:WINDOWSSYSTEMOEMZ.BAT file and writes to there commands that convert this hexadecimal dump to BMP file:
@echo off
debug < oeml.nik > nul
del oeml.nik
del oemz.bat
The resulting BMP file contains a logo with text:
CREATED BY NAENBGOURSG
The virus also contains commented text strings:
by NAENBGOURSG
SO.HT.AI.KS
231076-GREECE
VRD 19-4-1997
------------------------------
+ · ÷ x
x x
·
·
--------------------------------
Latin word -virus- means poison and is a derivative
of two Sanskritic roots --> -vishas->(poison)
and -ishus->(arrow).
NAENBGOURSG - SO.HT.AI.KS
M.SC. in MacroViral Science
---------------------------------
Macro.Word.Newyear
Description Macro.Word.Newyear
This is encrypted macro virus. It contains three macros: AutoOpen, FichierEnregistrer, FichierEnregistrerSous. The virus infects the global macros area and documents on AutoOpen. On saving documents with new name it displays the MessageBox:
Une erreur syst me emp che temporairement Word d'afficher la boite
Enregistrer sous
Since 15 of January the virus sets the password "JOKE98" on documents that are saved.
|