Virus Database

Rosebud.912

Description Rosebud.912

This is a very dangerous memory resident parasitic virus related to the "Jerusalem" virus family. It hooks INT 21h, and writes itself to the end of EXE files that are executed. Depending on the system date (if the sum of the current day and month is equal to 30 - Jan 29, Feb 28, etc.), the virus deletes files instead of infecting them. The virus contains the text string:
WARNING : This Rosebud virus is simple, because it was made for interest.
But Next virus will be bit more complex.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Tomsk

Description Macro.Word.Tomsk

The virus contain only one macro AutoOpen and replicates on opening documents. The virus does not manifest itself in any way, it contains the comments:
ÆÑ hnoV¿ s(tm) f«r Mi r«S«ft W«rd 6.Ä-7.Ä
( ) 1997-98 ÆÑchn«S«ft fr«m Æ«msk

Macro.Word.Toten

Description Macro.Word.Toten

This is an encrypted Word macro virus. It contains two macros:
Documents: NORMAL.DOT:
AutoOpen README
README DateiSpechern

The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are saved (DateiSpechern).
Depending on the current date the virus sets password for files.
There are MessageBoxes in the virus, but they are not displayed because of a bug. The texts in MessageBoxes looks as follows:
Makrovirus : Die Toten Hosen(DTH) aus D sseldorf
Heute ist der 02.01.2000. Sie haben den Makrovirus:
Die Toten Hosen
Der Virus wurd von M.N. aus Schwelm (BRD) am 08.06.1996
programmiert. Ich bin ein echter Hosen Fan.
Ha,ha,ha,ha,ha,ha,all
Das kennwort setzt sich zusammen aus Datum oder Zeit und den buchstaben
(TH) oder (TotenHosen) oder (40) oder (DTH)

Home