Virus Database

Weirdo.555

Description Weirdo.555

It's a not dangerous memory resident companion virus. It copies itself into EMS memory, hooks INT 21h and leaves its INT 21h handler code in conventional memory. On execution of .EXE-files it creates companion .COM-files. It contains the internal text strings:
Out of memory
[Weirdo (c) 93 CC/TridenT]
EMMXXXX0

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Class

Description Macro.Word97.Class

This virus contains two macros in one Module, "ThisDocument," and the macros have different names in documents and NORMAL.DOT:
Documents NORMAL.DOT
AutoOpen AutoClose - infection and trigger routines
ViewVBCode ToolsMacro - stealth, disables viewing macro code

The virus infects the global macros area upon the opening of an infected document. While infecting, the virus exports virus code to the C:CLASS.SYS and inserts it into NORMAL.DOT. Documents are infected in the same way.
The virus mutation (polymorphic) routine inserts comments into virus code, containing a user name, current date and time, and information about the active printer.
The virus uses an effective way to hide its code. By using special WordBasic operators, the virus installs its module, not into the standard area of macro programs, but into the area of Word classes - the area of standard routines that handle Word events, i.e., Word kernel. The virus appends its code to documents and templates, not as a user application (macro program), but as a "native" Word component. As a result, the virus is not visible in Tools/Macro and File/Templates (for what reason does the virus then hook ToolsMacro?)
The virus disables the AutoProtection. On the 31st, the virus displays the MessageBox:
This Is Class
?-?-?-?-?-?-?-?-?-?-?-?-?-?-?-?-?-?-?-?
? VicodinES /CB /TNN ?
?-?-?-?-?-?-?-?-?-?-?-?-?-?-?-?-?-?-?-?

Class.d
Each month from June until December on day 14, the virus displays the message:
Class.Poppy
I think is a big stupid jerk!

The virus also changes values in the registry keys:
HKLMSoftwareMicrosoftWindowsCurrentVersionRegisteredOwner = "VicodinES /CB /TNN"
RegisteredOrganization = "-(Dr. Diet Mountain Dew)-"

Class.bs
Upon infection, this virus modifies the system registry by writing "Clazz" as the registered owner of this Windows copy. Upon trying to view, the virus codes it with a probability of 25% and sets the "Clazz" password for active document, or, with the same probability, deletes all files in the current folder.

Macro.Word97.Claud.b

Description Macro.Word97.Claud.b

Macro.Word97.Claud.b is a macro virus that infects Microsoft word documents and templates. It disables MS Word's virus protection and hides the "Tools/Macros" menu.
The Macro.Word97.Claud.b virus displays the following comment lines at the end of the macro:
'Este es un V macro, Elaborado por c l a u d I o
'Este es el Comienzo de la era de los V Claudio

Home