Virus Database

Twin.351

Description Twin.351

It is a memory resident companion virus: when an .EXE file is executed, the virus creates .COM files with the same name (for example, XCOPY.EXE -> XCOPY.COM) and writes body of the virus into .COM file. After starts the file from DOS prompt DOS finds and runs .COM files first and only then .EXE files. And the first the .COM file (i.e. virus) is started. Then the virus installs and runs the .EXE files with a program.
The virus realizes quite interesting stealth algorithm: it sets the attribute HIDDEN to infected files, hooks INT 21h and controls the FindNext DOS function so that only files without HIDDEN attribute are displayed (in DOS prompt, Norton Commander, XTREE and so on).

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.FunFun

Description Macro.Word.FunFun

This Word macro virus contains three macros with random selected names. To access these macros the virus writes their names to the WIN.INI file in section [Intl] in strings Info1, Info2, Info3 (in case of infected system - NORMAL.DOT) or in internal document's variables VirName, VirNameDoc, VirNamePayload (in case of infected document).
To force Word to run its macros the virus assigns them to a random selected key, i.e. the virus takes control only when that key is pressed.
There are several modifications of this virus. They display the MessageBoxes:
"Funfun.a": funfunfun
"Funfun.b": DARKTREMOR
Dark Tremor
Polytest Virus ist Aktiv !!!

"Funfun.b" also drops multipartite virus "Smile".

Macro.Word.Fuzzy

Description Macro.Word.Fuzzy

This is an encrypted macro virus. It contains only one macro AutoOpen and infects the global macro area and documents on file opening. Depending on the system date and system random counter the virus sets for current document SummaryInfoTitle = "Fuzzy", SummaryInfoAuthor = "Microsoft" and the password "Fuzzy". The virus then displays the MessageBox:
Microsoft Fuzzy Word Macro Virus Version 1.0

Home