Trojan.Win32.KillDisk.f
Description Trojan.Win32.KillDisk.f
This Trojan is extremely dangerous. It installs itself on the system as a driver, and starting from 27th April it will delete data from the hard disk.
In systems running Windows 9x, the Trojan installs itself as the driver
MSGBS1.VXD
In systems running Windows NT/2000/XP and all subsequent versions, it installs itself as the driver
ACPI89.SYS
The Trojan also creates the following two files:
C:Program FilesInternet Explorerfileproc.txt
C:Program FilesInternet Explorerfilepath.txt
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.MVG
Description Macro.Word.MVG
The virus code cotains three macros: MVG, AutoOpen and FileSaveAs. The virus spreads on opening documents or saving them with new names. While infecting it creates a new macro by using commands stored as text constants, and executes it.
The virus does not manifest itself in any way. It contains the remarks:
--------(c)Macro Virus Generator-----------
Macro.Word.Naen
Description Macro.Word.Naen
This is an encrypted virus that contains four macros: OemLogo, FileTemplates, AutoOpen (MeoClose in NORMAL.DOT), OemClose (AutoClose in NORMAL.DOT).
The virus infects the global area on AutoOpen and writes itself to the documents on AutoClose. On entering File/Templates menu the virus displays the MessageBox:
Microsoft Windoze
Windoze Frotection Error
The virus creates the C:WINDOWSSYSTEMOEMINFO.INI file and writes the text to there:
[general]
Manufacturer=NAENBGOURSG
Model=209711 - SO.HT.AI.KS
The virus then creates the C:WINDOWSSYSTEMOEML.NIK file and writes to there a hexadecimal dump of OEMLOGO.BMP, then creates the C:WINDOWSSYSTEMOEMZ.BAT file and writes to there commands that convert this hexadecimal dump to BMP file:
@echo off
debug < oeml.nik > nul
del oeml.nik
del oemz.bat
The resulting BMP file contains a logo with text:
CREATED BY NAENBGOURSG
The virus also contains commented text strings:
by NAENBGOURSG
SO.HT.AI.KS
231076-GREECE
VRD 19-4-1997
------------------------------
+ · ÷ x
x x
·
·
--------------------------------
Latin word -virus- means poison and is a derivative
of two Sanskritic roots --> -vishas->(poison)
and -ishus->(arrow).
NAENBGOURSG - SO.HT.AI.KS
M.SC. in MacroViral Science
---------------------------------
|