Virus Database

Terronia Family

Description Terronia Family

These are harmless memory resident encrypted parasitic stealth viruses. They hook INT 21h, 2Fh and write themselves to the end of COM and EXE files that are executed or closed. On opening or debugging an infected file the viruses disinfect it. When Windows is run, the viruses disable their infection and stealth routines. The viruses contain the text string:
|||-(BOOBS-)||| Virus , Once again deep in Terronia Land 1997 Bari

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Niki

Description Macro.Word.Niki

This encrypted virus contains six macros: AutoExec, AutoOpen, FileApri, FileSalvaConNome, StrumMacro, NiKI. The virus infects the global area on AutoOpen and writes itself to the documents on FileApri (FileOpen?) and on FileSalvaConNome (FileSaveAs?).
The virus in some way modifies the Tools/Customize menu. Depending on the system time it runs its trigger routine (macro NiKi) that in some way modifies the current document and deletes *.DOC and *.DLL files in C:MSOFFICE and C:WINDOWSSYSTEM directories.

Macro.Word.Niknat.i

Description Macro.Word.Niknat.i

This encrypted macro virus contains four macros, it replicates on closing documents (AutoClose):
Documents NORMAL.DOT
EvaHzg EvaHzg
AutoClose DCloseAN
FileTemplates FileTemplates, ToolsMacro
TCloseAN AutoClose

On October 23 the virus creates the EVAH.BMP file with a porno-picture image inside in the Windows directory and sets it as the Windows background picture (wallpaper). The virus then also changes Windows color palette.
On entering the File/Templates and Tools/Macro Word menus the virus displays the MessageBox (stealth):
Microsoft Windows
Windows Protection Errorr

The virus also contains the comments, these comments depend on the virus version:
"Niknat.a,b,all":
by NAENBGOURSG
SO.HT.AI.KS
231076-GREECE
Thanks to NEURO
VRD 19-4-1997
VRP A.U.A (+.+.+)

"Niknat.i":
--------------------------------
Latin word -virus- means poison and is a derivative
of two Sanskritic roots --> -vishas->(poison)
and -ishus->(arrow).
NAENBGOURSG - SO.HT.AI.KS
M.SC. in MacroViral Science
---------------------------------

Home