Virus Database

V-Silence Family

Description V-Silence Family

These are dangerous memory resident polymorphic parasitic viruses. Being executed the viruses disinfect the host file, execute it and then infect again. Then the viruses hook INT 21h and write themselves to the beginning of EXE-files that are executed or closed. While opening the infected file the viruses disinfect it. The viruses do not disinfect the file if one of the archive utilities is executing: ARJ.EXE, PKZIP.EXE, AIN.EXE, RAR.EXE, or UC.EXE.
While infecting the viruses encrypt the beginning of the file, save that data to the file end, and then overwrite the file beginning with the virus copy. While disinfection the viruses read the data from the end of the file, decrypt and write it to the file beginning.
The viruses have the bugs, and in some cases they corrupt the files while infecting them.
The viruses delete the files:
C:WINSOL.EXE
C:WINDOWSSOL.EXE
C:WINWIN.COM
C:WINDOWSWIN.COM

The viruses do not affect the files if the file name begins with one of the strings, or if the file is placed in the subdirectory with such name. The strings are:
"V-Silence.4096":
WIN EXCE MSO ACAD MICROG COREL CD PM PAG
"V-Silence.5120":
WIN EXCE RumS MSO ACAD MICROG COREL CD PM DOS

The viruses also contain the internal text strings:
"V-Silence.4096":
1113 Sofia, Acad G.Bontchev str. bl.8 room 104, EUGENE NIKOLOV,
eugene@virbus.bg
Virtual Silenceall written by The Kid,Burgas,Bulgaria 30 December 1995.
Greets to Fridrik Skulason.Without the technical analysis of some viruses
in his F-PROT I would have never written this virus.
Question to Eugene Nikolov:You are the Dark Avenger,aren't you? MtE
"V-Silence.5120":
1113 Sofia, Acad G.Bontchev str. bl.8 room 104, EUGENE NIKOLOV,
eugene@virbus.bg
This is The Virtual Silence virus(LL Cool J alias)...written by The
Kid,Burgas,Bulgaria January'96.
You heard of the new album "Mr.Smith" from LL Cool J,no?It's the best thing
I've ever heard...especially this cool tune "Hey Lover" featuring Boyz II
Men.Go buy the album,you won't regret.
Once a marine,always a marine.
"It does not take a genius to write a virus - any average(!?) assembly
language programmer can easily(?) do it.".Oh,God,forgive them...they don't
know what they are talking about."After all,being a virus-researcher is a
risky job with various side effects - mental disorder for example...You
must be grateful at least a bit to us.We are the guys who make your money.
MtE

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Dreams.a

Description Macro.Word97.Dreams.a

This virus contains five functions in one module "Dream": AutoOpen, FileOpen, FileNew, FilePrint, FileExit. The virus replicates itself on any function activating, i.e. on documents opening, creating or printing. To copy its code the virus uses export/import functions via the temporary C:CONFI~1.~YS file.
On Word exiting the virus depending on the system random counter saves the current document with one of the names: HARDCORE.DOC, HEROINKILLS.DOC, LESBIANS.DOC, DESIRE.DOC, GRAVITYKILLS.DOC, R.I.P-TALON.DOC, HOPE.DOC. Depending on the system date it saves it either on the M: drive (before 15th of month) or on the F: drive (starting from 15th).
The virus erases the menu items "Tools/Macro" and "Tools/Templates and add-insall". On 21st of any month it creates the C:WINDOWSDREAMS.TXT file and writes the text to there:
.-=BadDReAms=-.
When you sleep
Do you see an angel in the dying light
Or can you see someone standing outside
Trying to set you alight.
Maybe you`ve seen Someone Somewhere before
That I might have loved had I never loved you
But you only see Me In bad dreams

Macro.Word97.Dworld

Description Macro.Word97.Dworld

Programmiert von RinCeWinD~[m@G]~ aka zWeiBLuM
Kontakt: Rincewind_mg@hotmail.com

---------------------------------------------------

|Danke an Lz? (besonders IarRagèN & LRay), BeTa CreW|
|und alle die mich kennen! |
|FæRDERT EURE LOKALE SZENE! |

---------------------------------------------------

Weitere Infektionen:
-----------------------------------------------------------------------
DateiName: Datum: Uhrzeit:

It also changes the properties:
UserName = "RinCeWinD~[m@G]~"
UserInitials = "~[m@G]~"
UserAddress = "Kontakt: rincewind_mg@hotmail.com"

The virus infects other documents upon their opening or creating (AutoOpen, AutoNew). For each infected document, the virus writes one line to the "DWORLD.INI" file with the name of an infected document, date and time of infection.
The virus turns off the Word virus protection (the VirusProtection option). It also disables the Tools/Macro menus and blocks Visual Basic editor (stealth).
Upon printing documents, if the date is the 24th of the month, the virus replaces all words "der" in the active document with the "der ~[m@G]~" string in 20% of the cases. With the same probability, it displays the message "Des Zauberer?s Finger sind im Spiel!", and appends the following text to the document:
allDie aufgekl€rten Brìder der schwarzen Nacht sagen:...
-HOOOOOLLDRIIOOOOO!!!-

If the date is the 12th of the month, the virus displays the message: "Des Zauberer?s Finger sind im Spiel!", and hides the mouse cursor.
The virus contains the following comments:
DiscwèrlD MakrèViruS -Dwèrld.MV.B- der magischen Gilde
Prègrammiert von Rincewind~[m@G]~
Kontakt: | rincewind_mg@hotmail.com |
!FæRDERT EURE LOKALE SZENE!
Ausgesetzt im J€nner 99
Danke an alle die mich kennen | besènders NJèker[SLAM] | cèRDy & LRay
Dwèrld.MV ist FleTsCheR und IarRaGèN gewidmet

????????????????????????????????????????????????????????????????????????
? !" %&/()=?->DiE auFgeKL€rTeN BRìdeR dER sCHwaRzeN NaCHt<-?=()&%$ "! ?
????????????????????????????????????????????????????????????????????????

Home