Virus Database

Win32.Small.1416

Description Win32.Small.1416

This is a simple Win32 virus that searches for PE EXE files in the current directory, and infects one of them, then exits. The virus doesn't save an original victim EXE-file entry-point, so files infected by this virus can't be cured.

Check other viruses! Be aware! Use Antiviral Software

Macro.Excel.Delta.a

Description Macro.Excel.Delta.a

This is an Excel macro virus. It contains one module Delta that contains 28 macros: API, Auto_Close, Auto_Open, bt_1, bt_2, Chk1, Chk2, Dstr, Ghst, Hdn, Hlt, Icn_1, Icn_3, ins, Ky, mcr, mcr1, mcr2, min, Prt, tgu, Trl, Thc1, Tim, Thc2, txt, xl4, Waw.
On opening an infected file the Auto_Open macro is executed. This macro to install the virus on computer runs macros: Tim, Icn_1, Icn_3, Chk1, Chk2, Dstr, mcr, xl4, Hdn.
Tim - sets macro Hlt on timer (is executed every 20 minutes)
Icn_1 - sets macro bt_1 on entering the File/New menu
Icn_3 - sets macro bt_2 on entering the File/Close menu
Chk1 - creates the infected file C:MSOFFICEEXCELXLSTARTEXCELVBA.XLA
Chk2 - copies the current file to EXCELVBA.XLA
Dstr - on January 5 it erases C:WINDOWSSYSTEM*.*, A:*.*, B:*.* and
displays the InputBox:
Delta Viruses
This Is The Example Of My Viruses ! You Can Modified, Added in
Order to be a Good Hacker ! Please Type My Virus Name to Continued
or I'll Destroy Your Computer ! < By Bui'95 >
If virus name is entered not correct, the virus displays the MessageBox
and shutdowns Word:
Sorry ..!, My Virus Name is Delta
mcr - erases the menu that contains the "Macro" substring
xl4 - sets new user name: "Delta Viruses (c)1995 Ver 1.20"

The virus also creates the C:MSOFFICEEXCELLIBRARYEXCELVBS.TXT file, writes its code to there and uses it on infecting.

Macro.Excel.Disaster

Description Macro.Excel.Disaster

This virus infects Excel sheets (XLS files). It contains five macros in one module "Disaster": Auto_Open, Infect, Unvisible, Butterfly, Auto_Close.
While loading an infected document Excel executes auto macros auto_open, and the virus takes control. The virus auto_open macro contains just one command, which defines the Unvisible macro as a handler of OnSheetActivate routine. As a result the virus hooks the sheet activate routine, and while opening a sheet the virus (the Unvisible macro) takes control.
When the Unvisible macro takes control, it executes the Infect macro which infects all active Workbooks. While closing an infected document Excel executes the Auto_Close macro. This macro erases all sheets except having the "Sheet" at the beginning of the name. This macro then saves infected sheet to the Excel Startup directory with the BOOK1.XLS name.
On Monday that falls on 1-5th day or month, or on Friday starting from 25th of month the virus on closing files executes the Butterfly macro that creates new sheet named "A" and deletes all other.

Home