Virus Database

VLAD.MonAmi.1098

Description VLAD.MonAmi.1098

This is a memory-resident parasitic encrypted virus. It hooks INT 21h and writes itself to the end of COM and EXE files that are accessed. It deletes the files ANTI-VIR.DAT, MSAV.CHK, CHKLIST.CPS, CHKLIST.MS. It contains the text strings:
[ Blue Sad v1.1 by Jimmy Sad at T.P.V.O ]

Check other viruses! Be aware! Use Antiviral Software

Macro.Excel.Tjoro

Description Macro.Excel.Tjoro

This Excel macro virus contains one macro (module) named "NoMercy", the macro contains six functions: Auto_Open, cek_global, infectglobal, inFuckIt, Fuck, Auto_Close.
To infect the system the virus creates the infected GLOBAL.XLM file in Excel startup directory and sets macros Fuck as auto-macro that is called when any sheet is activated. As a result the virus hooks sheets activating, and infects them. While infecting the virus searches for "NoMercy" module to prevent duplicate infection. If there are no such module, the virus copies its code to there.
On 11th of any month the virus displays the MessageBox:
Helloall
Hello there...you are infected with NoMercy!

Macro.Excel.Uedasun

Description Macro.Excel.Uedasun

This is an Excel macro-virus containing eight procedures in the module "A-TDK": Save, auto_open, scan, Status, DO_EVERYTHING, DO_SOMETHING, nexts, and check. The virus infects workbooks upon workbook opening or activating any of its sheets. The infection procedure creates an infected workbook with the name "TDK-MAC.XLS" in the Excel StartUp directory, and also infects the active workbook.
If the value in the "A16384" cell is not the "uedasan" text, the virus starts its payload procedure. In April, it removes all files with the extension ".SYS" from the C: root directory that also have hidden and system attributes set (C:IO.SYS, C:MSDOS.SYS). If the month is later than April and the time hour is less than six a.m., the virus removes all files in the current directory that have hidden and system attributes set.

Home