Virus Database

Sojourn.1369

Description Sojourn.1369

It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are executed. It does not infect anti-viruses and utilities SCAN, CLEAN, F-PROT, GUARD, COMMAND, TB*. Depending on the system time it appends to the C:CONFIG.SYS file the instruction: "DOS=SINGLE".
The virus also contains the text strings:
^Have you ever been to Sweden?^
CLEASCANF-PRGUARCHKDCOMMTB
^VIRAL SOJOURN (c)96 Evil Elk^

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Flu

Description Macro.Word.Flu

It is an encryted macro virus. It contains seven macros: AutoExec, AutoOpen, FileOpen, FileSave, Influenza, FileSaveAs, ToolsMacro (stealth).
The virus infects the global macros area on opening an infected document (AutoOpen) and affect other documents on saving (FileSave).
On September 10 and April 16 the virus displays the MessageBox:
Don't work too hard. Relax for a moment. It's your birthday!

It then creates the C:FLU.BAT file and writes the instruction to there:
echo Just get back to workall I will not do anything to your computer!

On entering the Tools/Macro menu the virus displays the MessageBox:
You cannot create, edit or delete your macro right now!
It's being updated.. Sorry for the inconvenience.

It also contains the comments:
This macro is dedicated to my girlfriend, RS
The one who love me and always do her best for me
And I make this as a gift
To always memorize her love, and mine too....
RS, I Love You...
Dibuat di Jakarta
Tanggal 29 September 1996

Macro.Word.Fom.a

Description Macro.Word.Fom.a

This is an encrypted Chinese Word macro virus. It contains five macros: AutoOpen, FOM, ZlockMacro, FileTemplates, ToolsMacro (stealth).
The virus replicates itself when documents are opened (AutoOpen). The infection routine is placed in the FOM macro, it is called by AutoOpen to infect a document/NORMAL.DOT.
The virus displays a MessageBox in Chinese.

Home