Virus Database

Renegade.1176

Description Renegade.1176

Renegade.1176
It is not a dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself into the middle of EXE files that are executed, opened or closed. On 17th of any month it displays the message:
(C) Renegade 1994. Hello Hacker`s !!!

Renegade.4509
It is a very dangerous memory resident encrypted multipartite virus. It hooks INT 8, 13h, 21h and writes itself into the middle of COM and EXE files that are executed or opened. The virus does not infect the files:
WEB AIDS ADINF HIEW CHKDSK SCAN VSAFE MSAV CLEAN -V

The virus also infects the MBR of the hard drive.
The virus manifests itself in several ways. It corrupts the files, calls some video effects, displays the messages:
Say THANKS to lovely Dr.Web for damage this fileall
Please wait ...Hey , LAMER ! Are you all right ?.. Not so good ?..Oh, don't
be afraid my little baby ,angry wolf if far away !...... bUt I aM sTiLL
HeRe ! AnD i Am HuNGRrry ! Aaarrrgghhh !... YoU iS _fOxPro or
pAsCAL_pROGraMmeR , iSn't It ?... Oogghh , YeEsss ! I WaNt to EaT YoU NoWww
! NoW YoU WiLL bEcOme ViCTiM of HACKER's REVENGE !

The virus also contains the text:
(C) Renegade 1995.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Gas

Description Macro.Word.Gas

This virus contains macros:
Documents NORMAL.DOT
AutoOpen GAS
I R, AutoClose, FileTemplates, ToolsMacro, Autoexec
A S, FileSaveAs

Depending on the current date it inserts into C:AUTOEXEC.BAT the commands:
BREAK OFF
If exist C:GAS.BAT call GAS.BAT
BREAK ON

To the C:GAS.BAT file the virus writes the commands that delete the *.JPG, *.GIF, *.BMP files on the C: drive, including subdirectories. Depending on current seconds the virus outputs the string to the statusline :
A s s a l a m u a l a i k u m

Macro.Word.Gavin

Description Macro.Word.Gavin

This is an encrypted macro virus. It contains only one macro named in FileSave in NORMAL.DOT and AutoOpen in documents. The virus infects the global macros area on opening an infected document and infects documents when they are saved.
On infecting global macros area (NORMAL.DOT) the virus saves current date in the CONTROL.INI file in [MS-Word] section, line "Compatibility". In 28 days the virus inserts the auto-correction: "Microsoft" -> "Microbollocks".
The virus contains the comments:
Gavin's Word Virus V2.0 - 1996
Platform Independant
*** NOT FOR RELEASE ***
In emergency contact gr.brock@ic.ac.uk

Home