Virus Database

V.1906

Description V.1906

It is a very dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM-files that are accessed. The virus checks the file name, and does not infect the files COMMAND.COM and IBM*.COM.
Depending on the system date and its internal counter the virus erases CMOS and disk sectors. The virus contains the internal text string:
COMMAND.IBM

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Innocence.a

Description Macro.Word.Innocence.a

This is an encrypted German specific Word macro virus. It contains 11 macros: AutoOpen, DateiOffnen, DateiSpeichern, DateiSpeichernUnter, FileOpen, FileSave, FileSaveAs, HilfeInfo, InnLib, Innocence, ToolsMacro. The complete set of virus routines is places in the InnLib macro. Other macros just call necessary routines from this macro.
The virus infects the global macros area (NORMAL.DOT) on opening an infected document. The virus also creates in Word StartUp directory the infected file named INLAY.DOT. Documents get infection on saving and saving with new name. Its presence virus detects by document's variable "Innocence", in infected documents it is equal to "Robert".
On opening any document the virus checks the presence of other viruses. In case of detection the virus displays the MessageBox in German and then MessageBox to request the virus disinfection. In case positive answer new virus is removed, and into the WIN.INI file in the field [Sense] the following strings are appended:
Killed= < the count of desinfection viruses >
WhichWasIt= < the name of virus >

Macro.Word.Innuendo

Description Macro.Word.Innuendo

The macro virus contains one macro AutoOpen and replicates when documents are opened. After infecting the virus sends current document by E-mail (File/Send menu). This E-mail has Subject = "Welcome to.." and Message = "Innuendo v1.00". The virus then displays the MessageBox:
Innuendo v1.00

Home