Virus Database

Teacher.2000

Description Teacher.2000

It is not a dangerous memory resident partly encrypted parasitic virus. It hooks INT 21h, 28h and writes itself to the end of EXE files. This virus halts the system, if it detects the memory resident debugger. Sometimes it displays a poem in Russian.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Dementia

Description Macro.Word.Dementia

This virus contains nine macros: AutoOpen, Dementia, FileOpen, FileSave, AutoClose, FileClose, FileSaveAs, ToolsMacro, FileTemplates. The infection routine is placed in the Dementia macro, all other macros call this macro when they are executed. As a result the virus replicates itself on opening, closing, saving and saving with new name. The virus does not manifest itself in any way.

Macro.Word.Demon

Description Macro.Word.Demon

It contains three macros, two of them have random selected names, the last one is AutoOpen in documents and AutoClose in NORMAL.DOT. To get these random names on infection the virus saves them in document's variables or in WIN.INI file.
To prevent duplicate infections the virus uses the description of the AutoClose macros. In infected files this description contains the string "Protects your computer". To detect itself the virus also creates the section "[I]" in WIN.INI file.
Starting from May and till December the virus removes itself from the system. It there is the text "Dark Master calling" in current document, and it is selected, the virus displays the MessageBox:
Microsoft WinWord DEMON
WINWORD HIDDEN DEMON
is happy to see his MASTER!!!
GREAT DAY !!!
This file is infected as # <¡«¼Ñ »« «½Ñ¡¿ >

Home