Berlin.869
Description Berlin.869
These are very dangerous memory resident encrypted parasitic viruses. They hook INT 21h and write themselves to the end of EXE files that are executed. The viruses delete the anti-virus data files: CHKLIST.TAV, TNTVIRUS.SUM, CHKLIST.MS, CHKLIST.CPS. They also try to erase data on the hard drive, but fail. They contain the text strings:
[ GrEEtZ fr0m ThE BeRliN UnDeRgRoUnD! Thiz ViRuS wAs wRiTTen bY Nitrate.
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Innuendo
Description Macro.Word.Innuendo
The macro virus contains one macro AutoOpen and replicates when documents are opened. After infecting the virus sends current document by E-mail (File/Send menu). This E-mail has Subject = "Welcome to.." and Message = "Innuendo v1.00". The virus then displays the MessageBox:
Innuendo v1.00
Macro.Word.Inside
Description Macro.Word.Inside
This virus contains one macro "autoOpen" in infected documents and two macros "AutoOpen" and "Disaster" in global macro area. It infects the global macro area (NORMAL.DOT) on opening an infected document and writes its code to documents that are opened.
In documents the virus keeps the infection routine in area of document's variables. While infecting NORMAL.DOT the virus ("AutoOpen" macro) creates the temporary file DISASTER.DEC, copies the document's variables to there and opens it. Newly created document contains a macro that infects the NORMAL.DOT.
While infecting a document the virus creates the same file DISASTER.DEC, writes its code to there and inserts this document into document's variables. Then the virus copies the "AutoOpen" macro to this document.
|