Virus Database

Velocet.2000

Description Velocet.2000

This is a very dangerous memory resident encrypted parasitic virus. It hooks INT 21h, and infects .EXE files that are executed. While infecting files, the virus encrypts its code and writes itself to the end of the file as overlay data - the virus does not modify the Module Length fields in the EXE header, and, as a result, the main virus code is placed out of actual EXE image. To gain control, the virus writes a 68-byte program to the middle of the EXE file, and sets the EXE Entry Point address to that program. When an infected file is executed, this program takes control, reads the virus code from the host file and executes it.
Starting from generation 8, 256 successfully infected files or on January 19th, the virus erases FAT on the hard drive, decrypts and displays the following message:
Velocet. By Dogorall

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Jim.b

Description Macro.Word97.Jim.b

Upon document closing, the virus checks running applications and if one of the following applications is found: Outlook, Internet Explorer or ICQ, the virus collects information about a computer and tries to send it to one of the FTP servers on the Internet.
The collected information includes:
First found .PWL file on drive C:
User name
Time document infected
Application
Country code
Free disk space
Generation of virus
Processor type
Operating system
The virus also searches for a Pegasus Mail application, and if it find one, it creates a message with an attached infected document.
If the MIRC client is installed on a computer, the virus drops a script that instructs MIRC to send an infected document to every computer joined to the same IRC channel as the infected computer.
The virus has a payload procedure that is triggered on second day of the month. This procedure inserts a text into the active document:
[Mr Jim/SeptiC/TI] - Do you have what it takes to become an international
bussiness man!?
[Mr Jim]/SeptiC/TI '99

Macro.Word97.Jota

Description Macro.Word97.Jota

This macro-virus infects Microsoft Word documents. Upon each document opening, if a document is already infected, the virus starts an internal counter. When the counter exceeds 100, the virus replaces the first 100 commas in documents with a word in Russian, and also deletes 100 randomly-selected words from documents.

Home