Virus Database

WeihNacht Family

Description WeihNacht Family

These are not dangerous memory resident parasitic virus. They hook INT 21h and write themselves to the end of .EXE files that are executed. On December, 24th they play a tune and then decrypt and display the message:
Ich hoffe, sie haben zu Weihnachten einen Virus-Scanner bekommen!

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Illiteral

Description Macro.Word.Illiteral

This is an encrypted Word macro virus. It contains three macros in documents and four macros in NORMAL.DOT: AutoOpen, Nod(AutoClose), Tiberium(FileTemplates, ToolsMacro).
The virus infects the global macros area (NORMAL.DOT) on opening an infected document and writes itself to documents that are closed.
On Sundays as well as on entering the Tools/Macro menu the virus sets the password for documents that depends on the current time. The virus then displays the DialogBoxes:
Brotherhood of NOD
User error !!, replace User !!
Enter new user name here:
If User name not fill, your data will be delete !
Brotherhood of NOD
Okay
We need to restart Word First

Then the virus writes the text to the C:WINDOWSNOD.INI file:
/----------------------------------------------------------|Virus name: Brotherhood Of NOD |
|Origin : Indonesia, Yogyakarta |
|Author : Foxz NoMercy Members |
|URL : http://www.geocities.com/ResearchTriangle/3996 |
----------------------------------------------------------/
Dear <User>,all
You was distrub this virus! please dont doit again
Password For <filename> = <password>
I'm fair !!, I let you know the password for
Your document. Peace!! and Unity!!
--><--><--><--><--><--><--><--><--><--><--><--><--><--><--

Macro.Word.Imposter

Description Macro.Word.Imposter

This is a plagiarism from "Word.Macro.Concept" and "Word.Macro.DMV". It contains two macros:
in infected document: AutoClose, DMV
in infected NORMAL.DOT: FileSaveAs, DMV

While infecting the system the virus receives the control in AutoClose document, renames DMV macro to FileSaveAs, then renames AutoClose to DMV. While infecting the files (FileSaveAs) the virus renames these macros back DMV -> AutoClose, FileSaveAs -> DMV.
While infecting the documents the virus displays the MessageBox:
DMV

One of the strings in the virus body looks like follows:
just to prove another point

Home