Radiaki.456
Description Radiaki.456
This is a very dangerous, non memory resident virus. It searches for .COM files and writes itself to the end of the files. It deletes all archives with the extensions RAR, ZIP and ARJ.
It only infects files which are between 10 and 64000 bytes in size.
It contains the following text string:
[X-Worm]
v1.0
by Dr. Radiaki // [UvC]
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Naen
Description Macro.Word.Naen
This is an encrypted virus that contains four macros: OemLogo, FileTemplates, AutoOpen (MeoClose in NORMAL.DOT), OemClose (AutoClose in NORMAL.DOT).
The virus infects the global area on AutoOpen and writes itself to the documents on AutoClose. On entering File/Templates menu the virus displays the MessageBox:
Microsoft Windoze
Windoze Frotection Error
The virus creates the C:WINDOWSSYSTEMOEMINFO.INI file and writes the text to there:
[general]
Manufacturer=NAENBGOURSG
Model=209711 - SO.HT.AI.KS
The virus then creates the C:WINDOWSSYSTEMOEML.NIK file and writes to there a hexadecimal dump of OEMLOGO.BMP, then creates the C:WINDOWSSYSTEMOEMZ.BAT file and writes to there commands that convert this hexadecimal dump to BMP file:
@echo off
debug < oeml.nik > nul
del oeml.nik
del oemz.bat
The resulting BMP file contains a logo with text:
CREATED BY NAENBGOURSG
The virus also contains commented text strings:
by NAENBGOURSG
SO.HT.AI.KS
231076-GREECE
VRD 19-4-1997
------------------------------
+ · ÷ x
x x
·
·
--------------------------------
Latin word -virus- means poison and is a derivative
of two Sanskritic roots --> -vishas->(poison)
and -ishus->(arrow).
NAENBGOURSG - SO.HT.AI.KS
M.SC. in MacroViral Science
---------------------------------
Macro.Word.Newyear
Description Macro.Word.Newyear
This is encrypted macro virus. It contains three macros: AutoOpen, FichierEnregistrer, FichierEnregistrerSous. The virus infects the global macros area and documents on AutoOpen. On saving documents with new name it displays the MessageBox:
Une erreur syst me emp che temporairement Word d'afficher la boite
Enregistrer sous
Since 15 of January the virus sets the password "JOKE98" on documents that are saved.
|