Virus Database

TheDraw Family

Description TheDraw Family

These are dangerous nonmemory resident overwriting viruses. They display the pictures that are constructed with TheDraw utility. They contain the strings:
TheDraw COM file Screen Save
Unsupported Video Mode

TheDraw.2267
It searches for .EXE files and overwrites them. It displays/contains the strings:
Wonderfull BBS - Jedina ponuda komercijalnog softvera (free !!!)
Svaki korisnik ima dnevno 45 min i 2 Mb za Download
Veliki izbor korisnih programa direktno sa CD-ROM-a
Veliki izbor konferencija,biltena i jos mnogo toga all

TheDraw.6530
It searches for .COM, .EXE and .OVR files and overwrites them. It there is EMS memory installed, and PC is in protect mode, the virus does some manipulations with EMS (resets protect mode?). It displays/contains the strings:
byCoprophage By - Jeff Cook1994 (c) - Thunderbyte
P l e a s e S u p p o r t T h e S o c i e t y F o r T h e
P r e s e r v a t i o n O f C u l t u r a l C o p r o p h e l i a
T a s t e s G r e a t ... L e s s F i l l i n g !

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Ozwer

Description Macro.Word97.Ozwer

This is a stealth macro virus. It infects global macros area (NORMAL.DOT template) on opening an infected document and hooks many events: documents open, close, save, print, paste and copy commands, etc. Other documents get infection on any of hooked actions. While infecting a document the virus changes MS Word window caption to "ø Microsoft Word".
To hide itself the virus disables menus:
Tools/Macro
Tools/Templates and Add-ins..
Tools/Customizeall
Tools/Options...
View/Toolbars

It also displays own ToolMacro dialog box where are no any macro listed. On try to open Visual Basic Editor the virus displays one of two messages (depending on MS Word localisation):
Error interno en Word Basic Err=1100e.
Imposible cargar bibliotecas din¡micas.
Compruebe que todos los archivos estŠn
en sus carpetas.
Si el problema persiste, consulte la guia
del usuario.
Word Basic internal error Err=1100e
Unable to load module 1x6004.
Check that all files are in their folders
and that they are not damaged.
If the problem persists, consult user's guide.

Every twenty minutes the virus checks words count in current document and if it is in ranges 350-400, 700-750, 900-950, 1000-1050, 1150-1200, 1300-1350 or 1500-1600 then in one case of four the virus mixes words in the document.

Macro.Word97.PaixVirus

Description Macro.Word97.PaixVirus

This virus contains seven macros in one module "PaixVirus97": AutoExec, AutoOpen, FileSaveAs, FileTemplates, PayLoad, ToolsMacro, ViewVBCode.
It infecting global macros area at opening an infected document and infects documents on saving them with new name.
After infecting NORMAL.DOT the virus displays the MessageBox:
PaixVirus97
La PAIX soit avec vousall
HAHA !!!!

On random selected days it displays the MessageBox:
PaixVirus97
C'est le jour J pour moi...

It then scrolls in the StatusBar the string:
Je veux avoir la paix!!!!!, merci

Home