Virus Database

VBS.GaScript

Description VBS.GaScript

VBS.GaScript is an Internet worm and script virus made with the help of the the virus script construction program Gate Script. The virus and worm code were both written in Visual Basic Script (VBS).
The Gate Script program facilitates the building of viruses and worms that spread via email.
Below is a selection of destructive actions Gate Script administers for generating worms:

copies worms to the system catalog
encrypts code
infects files on local disks (files with vbs and htm extensions).
displays messages on the monitor screen

There are three versions of the Gate Script constructor program. Most viruses generated with it contain mistakes and are therefore inoperative.
Gate Script screen shot.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Smac

Description Macro.Word97.Smac

This is a polymorphic macro-virus. It infects the global macros area on opening an infected document, and spreads itself to documents that are closed. The virus was named after one of its internal variables - "Smac".
The virus has stealth abilities, and on entering the ViewVBCode menu, it displays the message:
Illegal function in module 0xCB15C00

The virus contains six macros in one module "cb4111": AutoOpen, AutoExec, ViewVBCode, Do_The_Thing, AutoExit. The virus also has the Morph function that is used in virus polymorphic engine.
While infecting the NORMAL.DOT (global macros area), the virus also creates the infection AutoClose macro in there.
The virus contains the comments:
ThE wEiRd GeNiUs is back!
Greetings to the Codebreakers, VicodinEs & Lord Natas and to ALT-F11
Thanks for the cb4111 guide.
Until the next bug, greetings, WG

Macro.Word97.Sparkle

Description Macro.Word97.Sparkle

This is a stealth macro-virus. It contains three modules and 11 functions:
"Sparkle" - FileSave, Toolsmacro, Filetemplates, Sparkle,
Toolsmacro, Filetemplates, ViewVbCode,
"userform999" - ListBox2_Click, UserForm_Initialize, CommandButton2_Click,
CommandButton5_Click, UserForm_Click,
"userform900" - CommandButton1_Click, CommandButton2_Click,
CommandButton3_Click, CommandButton4_Click,
CommandButton5_Click, CommandButton6_Click, ListBox2_Click,
ScrollBar1_Change, UserForm_Click.

On saving files (FileSave), the virus disables the VirusProtection, infects the global macros area and documents.
The virus draws its own dialogue on entering the Tools/Macro menu (stealth). On pressing any button (except "Cancel"), the virus displays the MessageBox:
Microsoft Word
This program has performed an illegal operation and will shut down.

Home