Virus Database

Sabotager.3133

Description Sabotager.3133

It is not a dangerous memory resident parasitic polymorphic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. The virus checks the file names and does not infect the file if its name contains the symbols ID, WE or AD. In some cases the virus terminates execution of a program and displays the picture:
______________________
_____________________________
____________________________________
________________________________________
__________________________________________
_____________________________________________
_____________________________________________
_____________________________________________
_____________________________________________
__ __________ ____ ________
__ ______ __ ______
___ _______ _________
_______________ _________ __________
_____________ _________________________
___________ __________________ ___
___________________ _
SABOTAGER __________________
éÑ_ß¿_ 1.0 __________________ _
Written by _ _ _ _ __
S H U L D E R _______ _____________ ___
___________________________
___________________________
_________________________

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Slot

Description Macro.Word97.Slot

This virus in one module "SLOT" contains six macros: autoopen, slots, FileTemplates, autonew, autoclose, ViewVBcode. It replicates itself on creating new document, opening or closing.
On entering the Tools/Macro or Tools/Templates menus it displays the message:
Warning!!
That option is not installed, please install the HELP files to continue

The virus also sets the "SLOT" password for documents and plays a game: displays MessageBoxes, waits for input, compares input with three-digits random number and depending on it displays more MessageBoxes:
Macro Slot Game for Word97
Today is [current date] let's play a SLOTS game.
Try your luck! Your lucky numbers are..
Macro Slot Game for Word97
Bingo ! You win .
Macro Slot Game for Word97
Try to input the password or play again!
Macro Slot Game for Word97
Hey ! You can't do that. You must input the
right numbers or push the cancel button.
Macro Slot Game for Word97
OK !

Macro.Word97.Smac

Description Macro.Word97.Smac

This is a polymorphic macro-virus. It infects the global macros area on opening an infected document, and spreads itself to documents that are closed. The virus was named after one of its internal variables - "Smac".
The virus has stealth abilities, and on entering the ViewVBCode menu, it displays the message:
Illegal function in module 0xCB15C00

The virus contains six macros in one module "cb4111": AutoOpen, AutoExec, ViewVBCode, Do_The_Thing, AutoExit. The virus also has the Morph function that is used in virus polymorphic engine.
While infecting the NORMAL.DOT (global macros area), the virus also creates the infection AutoClose macro in there.
The virus contains the comments:
ThE wEiRd GeNiUs is back!
Greetings to the Codebreakers, VicodinEs & Lord Natas and to ALT-F11
Thanks for the cb4111 guide.
Until the next bug, greetings, WG

Home