Rasek.1310
Description Rasek.1310
This is a dangerous memory resident multipartite encrypted virus. While executing an infected file it writes itself to the MBR of the hard drive and hooks INT 13h, 12h. By hooking INT 13h this virus releases the stealth mechanism on reading the infected MBR. It also writes a trojan program to the floppy disk boot sectors. That program erases the hard drive FAT while loading from that floppy. Sometimes the virus also erases the FAT on loading from infected MBR.
By hooking INT 21h the virus infects COM and EXE files that are executed, it writes itself to the end of the files. The virus contains the text string "AND.COM" and does not infect the files that contains that string in their names (COMMAND.COM). The virus also contains the text strings:
RASEK v1.1,from LA CORUÑA(SPAIN).Jan93
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Master
Description Macro.Word.Master
This virus contains four macros - AutoOpen, FileSaveAs, ToolsMacro, ToolsOptions. The virus infects the system on opening an infected document (AutoOpen). It infects the documents that are opened (AutoOpen) or saved with new name (FileSaveAs).
On entering the Tools/Macro or Tools/Options menu the virus displays the MessageBox:
(c) 1997 Master of infection
Macro.Word.MDMA
Description Macro.Word.MDMA
Macro.Word.MDMA is an encrypted virus, it contains only one macro AutoClose and infects the system and files on closing a file.
On 1st of any month the virus corrupts the files depending on the installed system and then display the message box with the text:
MDMA_DMV
You are infected with MDMA_DMV.
Brought to you by MDMA (Many Delinquent Modern Anarchists).
Under Windows the virus deletes the C:SHMK file and overwrites the C:AUTOEXEC.BAT with the commands:
@echo off
deltree /y c:
@echo You have just been phucked over by a virus
As a result after rebooting all files in all subdirectories will be deleted.
Under Windows NT the virus deletes all files in the root directory as well as the C:SHMK file.
Under Macintosh the virus deletes the files in system directory(?).
Under other systems (Windows 95) the virus deletes the C:SHMK file and all *.HLP files in C:WINDOWS directory. The virus then sets some private profile strings and deletes all *.CPL files in C:WINDOWSSYSTEM directory.
|