Virus Database

SLH.308

Description SLH.308

It is a very dangerous nonmemory resident encrypted parasitic virus. It searches for COM files, then writes itself to the end of the file. On Fridays 13th the virus erases random selected sector on the C: drive and displays the message:
Satan's Little Helper

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Ochoy

Description Macro.Word.Ochoy

This is an encrypted macro virus containing five macros in infected documents and ten macros in global macros area (NORMAL.DOT):
Documents NORMAL.DOT
Ard01, AutoOpen Ard01
Ard02 Ard02, FileSave, AutoClose
Ard03 Ard03, FileTemplates, ToolsMacro, ToolsCustomize
Ard04 Ard04, FileOpen

It infects the global macros area on opening an infected document (AutoOpen) and copies itself to documents that are saved or closed (FileSave, AutoClose). Before infecting the virus deletes all macros in target. The virus stores the counter of infections in document's variable "ard01". Depending on this counter the virus either prints to the status line the text "O C H O Y * P K T B N I", or displays the MessageBox:
BNI - PKT
(c) Ardi Sunardi - 1 9 9 7

Macro.Word.Ofxx

Description Macro.Word.Ofxx

This is an encrypted virus containing three macros that have different names in global area (NORMAL.DOT) and infected documents:
NORMAL.DOT Infected files
Macro1 Ofxx AutoOpen - infects the global area on opening
Macro2 AutoClose Cfxx - infects the files on closing
Macro3 AutoExec Show - corrupted in samples I have

In most samples macro "AutoExec" ("Show") is damaged, but virus code is able to replicate itself without problems ever with damaged macro. The damaged macro contains following text:
at yang kaya dengan uap air bali yang berada di direktori WINDOWS
dan WINWORD telah hilang, jangan kaget, ini bukan ulah Anda, tapi
ini hasil pekerjaan sayaallBarang siapa yang berhasil menemukan
cara menangkal virus ini, saya aka j¡n memberi listing virus ini
untuk Anda !!! Dan tentu saja saya akan terus datang kesini untuk
memberi Anda salam dengan virus-virus terbaru dari saya...selamat !
Bandung,
C:PESAN.TXT

This text is very similar to the text included in the "Macro.Word.Bandung" virus.

Home