Virus Database

VLAD.Hemlock.3183

Description VLAD.Hemlock.3183

It's not dangerous memory resident polymorphic stealth multipartite virus. It hooks INT 9, 13h, 21h and writes itself at the end of COM-, EXE, and SYS-files are accessed. On execution of infected files it hits MBR of hard drive. On accessing to floppy disks it overwrites their boot sectors.
On Alt-Ctr-Del it emulates rebooting and stays memory resident. On execution of some programs it disables its stealth routine. It contains the internal text strings:
TBSCAN WIN CHKDSK PKZIP ARJ NDD SCANDISK LHA
co nm /d:f
Hemlock by [qark/VLAD]
OSDATA

VLAD.MegaStealth
It's a not dangerous memory resident stealth multipartite virus. It hooks INT 13h, 21h, 76h and writes itself at the end of .COM-files, MBR of hard and floppy boot sectors are accessed. It displays '¯' character on each INT 21h calls. Interrupts 13h, 76h are used by stealth routine. It contains the internal test string:
[MegaStealth] by qark/VLAD

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.SiliconC

Description Macro.Word97.SiliconC

The virus contains fourteen macros in one module "SiliconC": AutoOpen, AutoClose, FileSave, FileSaveAs, SendMail, Innocence, FilePrint, ToolsMacro (stealth), FilesTemplates, EditFind, ToolsWordCount, ViewVBCode, InfectDOC, and InfectGlob.
It infects the system macros area and documents upon calling one of these macros.
Upon closing files, saving or saving with new name, the virus sets a randomly selected password for documents. The virus also changes the mouse-button functions.
The virus sets document variables:
UserName = "Silicon Child"
UserInitials = "SC"
UserAddress = "532 Silicon Valley Kln. Angle Of Sin Loves You Stephanie"

In May, it displays the MessageBox:
Message from Global Network TCP/IP Instuction
I LOVE YOU STEPHANIEY

On August 28, it erases the files:
c:command.com
C:autoexec.bat
C:windowssystem.dat
C:windowssystem.da0
C:windowsuser.dat
C:windowsuser.da0

It then deletes all files in the "C:Progra~1" directory and displays the MessageBox:
Silicon Child -- By Angle Of Sin - POTion Forever
A WAR WIll BEING. BROUGHT ON BY NOT A RULER BUT A CHILD PROTECTED BY THE
ANGLE OF SIN. THIS WILL BE A DIGITAL WAR. ENERMIES USING THE LATEST
DEVICES OF TECHNOLOGY, IT WILL BE A WAR ABOUT ME AND YOU, GOVERNMENT AND
PRISONERS AND COPS AND CRIMINALS, THE WILL BE CALLED THE SILiCoN ChIlD.
The New World Will Be Run By The SiLiCon ChiLd and By The InFoMaTiOn
LibErAtIoN FrOnT.

Upon entering the Tools/Macro menu, it displays the MessageBox:
Fatal Systematic Error
An Invalid Command Was executed, the last processed command will be
terminated

It contains the comments:
This is a dedication to Stephanie Collinzallthe most beautiful girl in
the world.. May be I'm tripping right now but yea!. Thanks to ILF for
distributing Info....LONG LIVE ILF

Macro.Word97.Skaarj

Description Macro.Word97.Skaarj

This virus contains one macros, and it infects documents when an infected document is closed (Document_Close).
If the first infection occured more that two months previously, the virus displays one of the following messages:
"Nowhere to run, nowhere to hide "
"Life is short - boost yourself"
"It's nice to be important, but it's more important to be nice ;-)"
"I have no mouth and I must scream"
"Death is not punishment - it is disposal"
"Trust no one"
"Forget the past - work for the future"
"Time is NOW!"
"SMILE! :~)"
"Touch the SKY!"
"The truth is out there"

The virus contains the following copyright string:
"Mazdai II (Free-Harm Built) Version 2.2 L SKAARJ Y2K"
Macro.Word97.Skaarj.b
This version contains the following different messages:
"Nowhere to run, nowhere to hide "
"Life is short - boost yourself"
"It's nice to be important, but it's more important to be nice ;-)"
"I have no mouth and I must scream"
"Death is not punishment - it is disposal"
"Trust no one"
"Forget the past - work for the future"
"Time is NOW!"
"SMILE! :~)"
"Touch the SKY!"
"The truth is out there"
"RELAX! Don't do it" & vbCrLf & "Brooklyn Bounce"
"Mazdai II live!"
"We getting Faster, Harder, Scooter!"

The virus contains the following copyright string:
"Mazdai II (Free-Harm Built) Version 2.2.1 c SKAARJ Y2K"

Home