Virus Database

USTC.919

Description USTC.919

It is a harmless memory resident parasitic virus. It hooks INT 22h, returns control to the host program, waits for termination call INT 22h, then hooks INT 21h and writes itself to the end of .EXE files that are executed. The virus contains the ID-string:
USTC

Check other viruses! Be aware! Use Antiviral Software

Macro.Excel.Ultras.Freezer

Description Macro.Excel.Ultras.Freezer

This virus infects Excel worksheets. It contains one module "Sheet?" where '?' is '3' or '5' depending on the virus version. The "Sheet?" module contains auto-functions Auto_Open and Auto_Close. The virus module also contains the functions:
Joke
The virus infects the system and files upon opening and closing. It also creates an infected file in the Excel Startup directory, the file name is PERSONAL.XLS or PERSONAL.XLM depending on the virus version.
The viruses delete the Tools/Macro menu (stealth) and anti-virus programs:
C:Program FilesAntiViral Toolkit Pro*.*
C:Program FilesFindVirus*.*
C:f-macro*.*
C:Program FilesCommand SoftwareF-PROT95*.*
C:Program FilesMcAfeeVirusScan*.*
C:Program FilesNorton AntiVirus*.*
The virus displays the following MessageBox on the 14th of any month:
ULTRAS
You Infected XM.Freezer by ULTRAS
and deletes by DELTREE command all files in the C:PROGRA~1 directory. On the 28th of any month, it displays the MessageBox and deletes the files:
C:WINDOWSUSER.DAT
C:WINDOWSUSER.DA0

Macro.Excel.Yohimbe

Description Macro.Excel.Yohimbe

This is an Excel macro virus. The only module (macro) in this virus is named "Exec", it contains three subroutines: Auto_Open, DipDing, PayLoad and one function: SheetExists. Auto_Open routine is auto one, it is called by Excel on opening any file. On this call the virus infects PERSONAL.XLS. In case of any error, the virus infects all active books (files). Before returning the Auto_Open macro sets the DipDing subroutine as a timer handler that is called starting from 4:00pm. This subroutine infects all opened books.
The virus writes the string "Yohimbe" to the sheet header. The virus also sets PayLoad subroutine as called starting from 4:45pm. This routine re-sizes active sheet, draws a picture and inserts the text "FUCK YOU BUDDY" into the sheet.

Home