Virus Database

TMC

Description TMC

It is a harmless memory resident partly encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are accessed. The virus infects the files on floppy disks only. The virus checks the file names and does not infect the files: NO*.*, WE*.*, TB*.*, AV*.*, F-*.*, SC*.*, CL*.*, CO*.*, WI*.*, KR*.*.
The virus uses uncommon polymorphic engine - each time the virus installs itself into the memory it mixes blocks of its code and data and inserts random data. The virus also changes data offsets in its assembler instructions, constants and so on. As a result, the virus is not 100% encrypted, but it has no constant parts of code and ever the length of virus is changed.
Being installed into the memory the virus does not changes its code anymore, and all its replications have constant set of instructions. After reboot the virus installs itself into the memory and generates new set of instruction and infects files with this new set.
The virus contains the text:
* TMC 1.0 by Ender *
Welcome to the Tiny Mutation Compiler!
Dis is level 6*9.
Greetings to virus makers: Dark Avenger, Vyvojar, SVL, Hell Angel
Personal greetings: K. K., Dark Punisher

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Pelaku

Description Macro.Word.Pelaku

This Word macro virus contains nine macros: FileSave, FileSaveAs, FileTemplates, ToolsMacro, ToolsCustomize, AutoExec, AutoClose, AutoOpen, FileOpen.
It infects global macros area on opening an infected document (AutoOpen) and infects other documents on opening, saving and saving with new name (FileOpen, FileSave, FileSaveAs).
On opening a document before infecting the virus deletes all macros in there (if they exist). When closing the virus rewrites the FileOpen macro (tries to protect itself against other viruses?)
On August 19 it displays the MessageBox:
Happy Birthday, Pakis Pratiwiall
Hari ini Pakis Pratiwi merayakan Hari Ulang Tahun... Matikan komputer,
tinggalkan semua pekerjaan, istirahatkan pikiran, ucapkan selamat kepada
Pakis Pratiwi.

On November 20 it displays the MessageBox:
Happy Birthday, NdeKlaimber...
Hari ini NdeKlaimber merayakan Hari Ulang Tahun... Matikan komputer,
tinggalkan semua pekerjaan, istirahatkan pikiran, ucapkan selamat kepada
NdeKlaimber.

Starting from 1998, starting from 19:00 the virus displays the UserDialog:
NdeKlaimber Menggugat ...
Berawal dari sebuah kepedihan... NdeKlaimberÖ dicampakkan dan
dihinakan... terpuruk bagaikan sampah busuk... NdeKlaimberÖ merintih
dengan segumpal dendam mendidih !!!
Kini saatnya NdeKlaimberÖ menunjukkan... masih adanya kekuatan untuk
membungkam mulut-mulut tak berperasaan... sebab hasrat untuk menjadi yang
terbaik adalah sesuatu yang sangat manusiawi... NdeKlaimberÖ manangis
harus melibatkan semua orang.
1997 NdeKlaimberÖ I'm Coming...

Macro.Word.Pelo

Description Macro.Word.Pelo

This virus contains five encrypted macros:
Documents NORMAL.DOT
in in
autoclose close
a autoclose
i arquivoimprimir
ip arquivoimprimirpadrão

The virus infects the document and global macros area on closing files. On printing it appends to the end of current document the string:
VOCÊ FOI INFECTADO PELO VÍRUS VALADARES!

Home