Virus Database

Ultimate.982

Description Ultimate.982

This is a very dangerous non memory-resident encrypted parasitic virus. It searches for COM files, then writes itself to the end of the file. The virus decryption loop is placed at the file beginning.
Each month starting from June, from 20th till 31th the virus displays the message and format the hard drive:
I twist de truth, I rule the world.
This virus also disables several anti-virus memory resident monitors and deletes the anti-virus data files:
CHKLIST.MS
ANTIVIR.DAT
TBUTIL.DAT
CHKLIST.CPS
NAV_._NO
MSAV.CHK
CHKLIST.TAV
SMARTCHK.CPS
AV.CRC
AVP.CRC
IM.PRM
IV.INI
IVB.INI
IVB.NTZ
The virus also contains the text string:
TBMEMXXXTBCHKXXXTBDSKXXXTBFILXXX
[Ultimate Evil III] by Vecna.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Why

Description Macro.Word.Why

This virus contains only one macro, but while infecting copies it to two macros in documents and to three macros in NORMAL.DOT:
documents: AutoOpen, makemacros
NORMAL.DOT: AutoOpen, AutoClose, makemacros

The virus infects the global macros area (NORMAL.DOT) on opening an infected file (AutoOpen), and infects documents that are opened or closed (AutoOpen, AutoClose).
The virus displays the DialogBox:
Why Why Why
Why doesn't pepole work?
No money
No drink
No eat
No instant noodles
No lunch box

Macro.Word.Williamto

Description Macro.Word.Williamto

This is an encrypted Word macro virus. It contains 16 macros: Halim, FileNew, AutoOpen, FileOpen, FileSave, FileClose, FilePrint, HelpAbout, Williamto, FileSaveAs, ToolsMacro, FormatStyle, JustifyPara, ViewToolBars, FileTemplates, ToolsCustomize.
The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are opened, saved or saved with new name (FileOpen, FileSave, FileSaveAs).
This is the stealth virus: it draws its own dialog on entering Tools/Macro menu, on pressing any button the virus displays the MessageBox:
WordBasic Err = 7
Not enough memory

After opening a file the virus displays the message:
Williamto Virus
Williamto WordBasic Virus
Programmed by Williamto Halim
Virus Research Laboratory
Dedicated to Angelia Hadeli

On error while saving files the virus displays:
Attention!!!
Williamto Halim always lives in your computer

On closing files it displays:
File Close
Please close it later! Let's have fun!

On July 9 it displays:
Nice Day
Happy Birthday Amgelia Hadeli by Williamto Halim

The virus also replaces the "About Microsoft Word" with:
About Microsoft Word
Williamto WordBasic Virus
Programmed by Williamto Halim
Virus Research Laboratory
Dedicated to Angelia Hadeli

On printing documents the virus erases original text and prints its text:
Welcome to Williamto Word Macro Virus
I'm sorry about this but your computer has been infected by
Williamto Word Macro Virus
Please beware about this!!!
This Virus will destroy your data in your disk!!!
Copyright 1997 Virus Research Labs (Jakarta/Indonesia)

While printing the virus outputs to the status line the text:
[ Welcome to Williamto Word Macro Virus - Programmed & Written by
Williamto Halim the Hackers - Virus Research Laboratory ]

On November 11th the virus formats the hard drive and displays the MessageBox:
Attention!!!
I will format your hard disk now, ha-ha-ha!

Home