Virus Database

Win16.Vecna.832

Description Win16.Vecna.832

This is a memory resident Windows 3.xx parasitic virus. It infects NE EXE files. While infecting the virus looks for "cave" in file structure: a not used block between end of first file segment and beginning of next one. If there are 152 bytes free, the virus writes its loader to there and modifies the NE header so that this loader takes control when infected file is executed. The virus then saves its complete code to the end of the file without any changes in NE header (as an overlay code).
When an infected file is executed, the loader routine takes control. It reads virus rest code from the end of the file and leaves it in the system memory: it allocates a block of memory and hooks INT 21h by using DPMI calls. The virus then infects NE EXE files that are executed.
The virus does not manifest itself in any way, it contains the text strings:
[BONK] by Vecna/29A (c) 1998
New technology for old header formatsall

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.SiliconC

Description Macro.Word97.SiliconC

The virus contains fourteen macros in one module "SiliconC": AutoOpen, AutoClose, FileSave, FileSaveAs, SendMail, Innocence, FilePrint, ToolsMacro (stealth), FilesTemplates, EditFind, ToolsWordCount, ViewVBCode, InfectDOC, and InfectGlob.
It infects the system macros area and documents upon calling one of these macros.
Upon closing files, saving or saving with new name, the virus sets a randomly selected password for documents. The virus also changes the mouse-button functions.
The virus sets document variables:
UserName = "Silicon Child"
UserInitials = "SC"
UserAddress = "532 Silicon Valley Kln. Angle Of Sin Loves You Stephanie"

In May, it displays the MessageBox:
Message from Global Network TCP/IP Instuction
I LOVE YOU STEPHANIEY

On August 28, it erases the files:
c:command.com
C:autoexec.bat
C:windowssystem.dat
C:windowssystem.da0
C:windowsuser.dat
C:windowsuser.da0

It then deletes all files in the "C:Progra~1" directory and displays the MessageBox:
Silicon Child -- By Angle Of Sin - POTion Forever
A WAR WIll BEING. BROUGHT ON BY NOT A RULER BUT A CHILD PROTECTED BY THE
ANGLE OF SIN. THIS WILL BE A DIGITAL WAR. ENERMIES USING THE LATEST
DEVICES OF TECHNOLOGY, IT WILL BE A WAR ABOUT ME AND YOU, GOVERNMENT AND
PRISONERS AND COPS AND CRIMINALS, THE WILL BE CALLED THE SILiCoN ChIlD.
The New World Will Be Run By The SiLiCon ChiLd and By The InFoMaTiOn
LibErAtIoN FrOnT.

Upon entering the Tools/Macro menu, it displays the MessageBox:
Fatal Systematic Error
An Invalid Command Was executed, the last processed command will be
terminated

It contains the comments:
This is a dedication to Stephanie Collinzallthe most beautiful girl in
the world.. May be I'm tripping right now but yea!. Thanks to ILF for
distributing Info....LONG LIVE ILF

Macro.Word97.Skaarj

Description Macro.Word97.Skaarj

This virus contains one macros, and it infects documents when an infected document is closed (Document_Close).
If the first infection occured more that two months previously, the virus displays one of the following messages:
"Nowhere to run, nowhere to hide "
"Life is short - boost yourself"
"It's nice to be important, but it's more important to be nice ;-)"
"I have no mouth and I must scream"
"Death is not punishment - it is disposal"
"Trust no one"
"Forget the past - work for the future"
"Time is NOW!"
"SMILE! :~)"
"Touch the SKY!"
"The truth is out there"

The virus contains the following copyright string:
"Mazdai II (Free-Harm Built) Version 2.2 L SKAARJ Y2K"
Macro.Word97.Skaarj.b
This version contains the following different messages:
"Nowhere to run, nowhere to hide "
"Life is short - boost yourself"
"It's nice to be important, but it's more important to be nice ;-)"
"I have no mouth and I must scream"
"Death is not punishment - it is disposal"
"Trust no one"
"Forget the past - work for the future"
"Time is NOW!"
"SMILE! :~)"
"Touch the SKY!"
"The truth is out there"
"RELAX! Don't do it" & vbCrLf & "Brooklyn Bounce"
"Mazdai II live!"
"We getting Faster, Harder, Scooter!"

The virus contains the following copyright string:
"Mazdai II (Free-Harm Built) Version 2.2.1 c SKAARJ Y2K"

Home