Virus Database

Pux.1295

Description Pux.1295

It is a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. It contains the text string: "chklist.cps chklist.ms" and deletes these files. On opening some (anti-virus?) programs it corrupts the data on the disk. It changes the data in CMOS memory.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Hunter.a

Description Macro.Word.Hunter.a

These are encrypted German-specific macro viruses. They contain three macros: AutoOpen, DateiNeu, ExtrasMakro. The viruses do not use any copy-macros function to spread themselves. To infect the system they save an infected document to the Winword startup directory with the name:
"Hunter.a": WINWORD.DOT
"Hunter.a,b": AutoStrt

The viruses then register that file as "Add-In" template.
The viruses infect the documents on DateiNeu (FileNew) call. They create new document, insert the infected Add-In and clean its contents. As a result on creating new file the virus loads already infected clean file (template).
The ExtrasMakro (ToolsMacro) macro is used to hide virus macros in infected system.
"Hunter.a,b" depending on the system timer display the MessageBox:
<HeadHunter V3.0>
One - You lock the target
Two - You bait the line
Three - You slowly spread the net
And four - You catch the man

"Hunter.c" depending on the system timer inserts into its macros random selected strings.
The virus contains the commented texts, the second line contains different version numbers and dates in viruses:
********************************************************************
*** <HEADHUNTER V3.0> by Neurobasher, 17.10.1995, Germany ***
*** Boring experimental Winword virus with minor retro & stealth ***
********************************************************************
*** "I'm looking for a man who knows the rules of the game" ***
*** "Who's able to forget them to realize my aim" ***
********************************************************************

Macro.Word.Hybrid

Description Macro.Word.Hybrid

This encrypted virus contains three macros: AutoOpen, AutoClose, FileSaveAs and infects the system while opening an infected file (AutoOpen), and infects the documents while saving them (FileSaveAs).
As well as "Hassle" this virus is based on Microsoft macro anti-virus ScanProt.

Home