Syrian Family
Description Syrian Family
These are dangerous memory resident overwriting viruses. They hook INT 21h and overwrite COM and EXE files that are executed or loaded as overlays. They display the message "Bad command or filename" before return to DOS. They contain the text strings:
"Syrian.241": Syrian Brain II
MS-DOS v4.22 Volume label for drive Z is Infected!
"Syrian.412": Syrian Brain II
"Syrian.412" searches and deletes the files
C:SYRIAN??.II?
C:*.BAT
C:*.SYS
C:*.COM
C:*.EXE
C:AUTOEXEC.*
C:CONFIG.*
and then creates the subdirectories:
C:The
C:Syrian
C:Brain
C:II
C:Has
C:Struck
Check other viruses! Be aware! Use Antiviral Software
Macro.Word97.Nova
Description Macro.Word97.Nova
The virus contains two auto-macros: AutoClose and AutoExit. It spreads on documents closing. On Word exiting on July 28th the virus displays the message:
Meu anivers¡rio
Parab©ns para mim!
On others dates it displays another message:
Nova Vtima
Fechando 2807M!
Macro.Word97.Novosib.a
Description Macro.Word97.Novosib.a
This is Russian macro virus. It contains four macros:
Documents NORMAL.DOT
AutoOpen AutoOp
Fantom Fantom
Fuck FileOpen
AutoClose AutoClose
It infects the global macros area and documents on files opening. The virus contains comments and displays MessageBoxes in Russian.
|