Virus Database

BAT.Sys

Description BAT.Sys

This is a harmless batch virus just 602 bytes of length. It uses "worm" technology to spread: on floppy disks the virus replaces the AUTOEXEC.BAT file and is automatically executed when the system is loaded from such disk, on hard drive the virus replaces SYS.COM file and is executed when DOS is transferred on a new disk.
On loading from infected floppy disk the virus looks for C:WINDOWSCOMMANDSYS.COM file, renames it to SYS.OLD in the same directory, sets Hidden attribute for this file and copies itself to the SYS.BAT file to the same directory.
As a result when a users runs SYS command the virus takes control. The virus then temporary renames SYS.OLD to SYS.COM, executes it, renames it back to SYS.OLD and copies itself to the AUTOEXEC.BAT file on destination disk.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Gamble

Description Macro.Word97.Gamble

This is a stealth macro virus. It contains 3 modules and 11 functions: AutoOpen, Gamble1, ToolsMacro, CommandButton2_Click, CommandButton5_Click, Image1_Click, Label2_Click, Label3_Click, Label4_Click, UserForm_Click, CommandButton1_Click.
On opening an infected file the virus disables the VirusProtection and infects the global macros area (NORMAL.DOT), then on opening not infected files the virus infects them.
The virus substitutes the Tools/Macro menu (stealth), on pressing the "Create" button it displays the MessageBox:
Memory Allocation Error
Not Enough Memory To Complete The Request

On Mondays the virus displays the DialogBox:
Word Macro97 Virus "The Gambler" By Talon 1997
You System Is Infected By "The Gamble" Word Macro Virus
I Will Give You One Chance To Save Your Files, If You Can Guess The
correct Number between 1 And 10, I Will Return Your System To Your Control
If Your Wrong, Well We Won`t Go There. Do Not Not Turn Your System
Off. Your system FIles Have Been Encrypted With A Random Number, If This
Is Not Completed Your System Will Not Be Able To Reboot. Just Play Along
And Hope Your A Good Guess.
When Your ready To Play Press Here

On pressing the mouse button on Dialog the virus displays the MessageBox:
Trying To Cheat??
Are You Trying To Cheat?? One More Attempt like That And it's Over

On pressing "HERE" button the virus ask for a number from 1 till 10. On entering '5' the virus display the MessageBox:
Your A Winner
Good Guess, It's All Yours

In any other case the virus sets the password to current documents and exits Windows.

Macro.Word97.GamesVirus

Description Macro.Word97.GamesVirus

This virus contains seven macros in one module "GamesVirus": AutoExec, AutoOpen, FileSaveAs, FileTemplates, PayLoad, ToolsMacro, ViewVBCode.
It infects the global macros area on opening an infected document and infects documents on opening or saving with new name.
On entering the Tools/Macro and File/Templates menus the virus displays the MessageBoxes:
Microsoft Word
accès refusé!!!!
Microsoft Word
Fonction Sub inconnu

Depending on the system date and time the virus manifests itself in several ways. If current number of seconds is 1, the virus writes to the Subject field in FileSummaryInfo the text:
GamesVirus est avec vous, HAHA !!

If current number of minutes is 1, the virus writes the string to the StatusBar:
Remerciement à GamesVirus et à son auteur: ZeMacroKiller98

On tje 1st of any month it calls the Payload macro which displays several MessageBoxes and user forms. Depending on user's input the virus display MessageBoxes, erases system files, appends to the end of C:AUTOEXEC.BAT file instructions that format the hard disk, or in cycle draws the text in the status line:
Tu es le meilleur, bravo de la part de GamesVirus et de son auteurall.

Home