Virus Database

Tiso.1279

Description Tiso.1279

This is a harmless memory resident multipartite encrypted (in files) virus. It infects both COM and EXE files. On execution of infected file it hits MBR of hard drive. On loading from infected disk it hooks INT 08h, waits for DOS loading and then hooks INT 21h. It writes itself at the end of files that are executed.
This is a stealth virus on accessing to infected hard drive, it hooks INT 13h to use that function.
Sometimes this virus decrypts and displays:
Nech zije Jozef Tiso, prvy slovensky prezident !

Check other viruses! Be aware! Use Antiviral Software

Macro.Excel.Emperor.b

Description Macro.Excel.Emperor.b

This virus infects Excel sheets. It contains one macro (module) with the name "Emperor[number]" that contains five functions:
Auto_Close, CheckFile, WriteVirus, ScreenTool, MenuDelete.
Upon opening (closing), the infected Excel file executes the Auto_Open (Auto_Close) virus function. This function summons the check_file (CheckFile) function that sets a four-digit password to the virus sheet. The virus then makes visible all hidden windows, looks for the "Emperor" module in all Workbooks and infects uninfected ones. While infecting, the virus copies its macro with the name "Emperor[number of infection]". The virus then closes all windows that were opened during infection.
The virus deletes the menus: Worksheet View - Toolbars, Format - Sheets, Tools - Scenario; Module - Edit/Delete, Tools/Menu Editor, Tools/Protection.
On Mondays and Saturdays, it displays the MessageBox:
The First Emperor Ver 1.10
[the rest of text is in unknown coding]

Macro.Excel.Extras.a

Description Macro.Excel.Extras.a

This virus infects Excel sheets. It contains fiveteen functions in one random named module: Auto_help, Auto_Open, Auto_Close, Auto_Exit and others with random names.
While infecting sheets the virus copies its module with a randomly selected name. While infecting Excel the virus creates an infected sheet in the Excel startup directory. The name of this sheet depends on the installed system:
System File name
------ ---------
Windows 3.xx EXTRAS.XLS
Macintosh Macintosh Extras
Windows 95/NT/all Windows Extras.xls

Depending on the system random counter the virus creates directories with random selected names. Starting from 1999 the virus hides the selected Excel menus randomly.

Home