Virus Database

Bebe.486

Description Bebe.486

These are nonresident dangerous viruses. They affect .COM-files in the current directory. They increase the size of infected file up to a paragraph, copy themselves at the file end and alter its first 14 bytes (PUSH AX; all ; JMP FAR Loc_Virus ). The viruses have an error - doesn't restore DTA. This might result in hanging up the computer. There is one more delicate error: they doesn't take into account that INTEL 80x80 processor has a conveyer, and modifies the command following the current one, the result is that the viruses work only on old IBM PC models. Apart from the above text the viruses contain the string "*.COM".
The viruses are nonresident, but they create a small memory-resident program. With this purpose they copy a part of viruses' body to the interrupt vector table at the address 0000:01CE and sets INT 1Ch or INT 21h to this program.
"Bebe.486" hooks INT 21h and while writing into file (INT 21h, f.40h) it changes '+' to '-' and '-' to '+' in buffer is writing.
"Bebe.1004" hooks INT 1Ch (timer) and some time later displays the following message:
+-------- VIRUS ! ------+
ƒ Skagi "bebe" > ƒ
+-----------------------+

After the word "bebe" is typed in from the keyboard, the virus answers: "Fig Tebe !".

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Newyear

Description Macro.Word.Newyear

This is encrypted macro virus. It contains three macros: AutoOpen, FichierEnregistrer, FichierEnregistrerSous. The virus infects the global macros area and documents on AutoOpen. On saving documents with new name it displays the MessageBox:
Une erreur syst me emp che temporairement Word d'afficher la boite
Enregistrer sous

Since 15 of January the virus sets the password "JOKE98" on documents that are saved.

Macro.Word.NF

Description Macro.Word.NF

It is an extremely silly encrypted virus containing nothing except infection routines. Summary length of its two macros (nf, autoclose) is just 286 bytes.
Both virus macros contains infection routines. First macro infects global area while closing an infected document (it is named "autoclose" in infected documents and "nf" in NORMAL.DOT), second macro infects documents that are closed (it is named "nf" in infected documents and "autoclose" in NORMAL.DOT). So the virus exchanges names of these macros as several macro viruses do - while infecting a file or global area it copies "nf" macro with name "autoclose", and "autoclose" with name "nf".
NORMAL.DOT Infected files
Macro1 nf autoclose
Macro1 autoclose nf

While infecting the system the virus displays the string "Infected!", while infecting a file the virus displays "Traced!".

Home