Virus Database

TheWanderer.1448

Description TheWanderer.1448

It is a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the beginning of COM and to the end of EXE files that are accessed. Depending on the system time and date the virus fills the disk sectors with the string:
[The Wanderer, June 5th,1994 Korea]

Check other viruses! Be aware! Use Antiviral Software

Constructor.DOS.PS-MPC

Description Constructor.DOS.PS-MPC

PS-MPC (The Phalcon/Skism Mass-Produced Code Generator) is the second most known virus constructor, after VCL. The features of that constructor are described in the documentation that is distributed in the main PS-MPC package:
The Phalcon/Skism Mass-Produced Code Generator is a tool, which generates
viral code according to user-designated specifications. The output is in
Masm/Tasm-compatible Intel 8086 assembly, and it is up to the user to
assemble the output into working executable form. The features of the
PS-MPC include the following:
- Over 150 encryption techniques, randomly generated during each
run of the PS-MPC
- Compact, commented code, much tighter than VCL
- COM/EXE infections
- Both resident and nonresident viruses
- Two types of traversals for nonresident viruses
- Three types of high memory residency routines for TSR viruses
- Optional infection of Command.Com
- Critical error handler support

The PS-MPC constructor was released in 1992 and distributed in source code as well as in executable files. That is one of the most popular constructors, and several other constructors G2, IVP were created by using the PS-MPC sources.
That constructor creates source ASM files of the virus. The user can select the virus features: encrypted or not, memory resident or not, COM/EXE/COM and EXE infection, effects etc.
It seems that the viruses from "Arcv" family are based on PS-MPC constructor.

Constructor.Macro.Word.Cvck

Description Constructor.Macro.Word.Cvck
This is a CVCK-based virus. It contains 11 macros: AutoExec, AutoOpen, Action, Action2, stdClose, HelpAbout, Organizer, ActionDate, ToolsMacro ( Ñ+ ), FileTemplates, and ToolsCustomize.
It infects the global macros area upon the opening of an infected document, and is written to documents upon closing.
On the 11th and 31st, it displays DialogBoxes, and upon entering the Tools/Macro and File/Templates menus, it displays the following:
Chicken say all......
[pox-poX-pOX-POX-POx-Pox-pox]
Hello there......., this command was blocked by Chicken Pox Macro Virii
This is sample from Our Generator Virii, we named our generator CVCK V0.2.
It's very user friendly !, try it ! This Virii is not Dangerous !, If you
want try our CVCK V0.2 email Us on "nomercy12@hotmail.com"

Cvck.b
This is a CVCK-based virus. It contains six macros: AutoExec, AutoOpen, Action, Stealth, StlhClose, and ActionDate. In NORMAL.DOT, the virus has three additional macros: ToolsMacro, ToolsCustomize, and FileTemplates.
It infects the global macros area upon opening an infected document, and it is written to documents upon closing.
Upon entering the Tools/Macro and File/Templates menus, the virus erases files in the C:WINDOWS directory. On Fridays, it erases the text in the current document.
Cvck.c
This is a CVCK-based virus. It contains six macros: AutoExec, AutoOpen, Action, Stealth, StlhClose, and ActionDate. In NORMAL.DOT, the virus has three additional macros: ToolsMacro, ToolsCustomize, and FileTemplates.
On the 13th of any month, it displays the DialogBox:
Visit NoMercy WEB PAGE !

http://www.geocities.com/ReseachTriangle/3996
Welcome Again buddy!. It's nice create a Virus, why you don't try?
Like always, We made new If Our Macro Viruses was detectable by famouse AV
Visit http://www.geocities.com/ReseachTriangle/3996 for know newest
Macro Virus from Us and Indonesian Macro Virus!

The virus also contains the comments:
--------------------------------------------
Created using CVCK v.01 b
(C)CrazybitS 1997, Yogyakarta, Indonesia
--------------------------------------------
greeting to
-Cicatrix major collector
-D.Giovanni
-All Macro virii creator
-You that has seen the decription macro

Cvck.d
This is a CVCK-based virus. It contains ten macros: AutoExec, AutoOpen, Action, stdClose, FilePrint, ActionDate, ToolsMacro, EditAutoText, FileTemplates, and FilePrintDefault.
On the 1st and 13th of any month, it erases the text in the current document, and displays the following DialogBox:
You have fOX'Z in your computer !
Hey, No body can use Microsoft Word Today !!
Yogyakarta, Indonesia by :
Fox'z,

On printing a document the virus inserts the text:
Try to print tomorrow buddy , today your computer want rest (today is a
holiday?) --Foxz--

Home