Virus Database

Win32.Xorala

Description Win32.Xorala
Xorala is a harmless non-resident parasitic Win32 virus. It recursively searches for Win32 PE EXE files in the Windows directory and the Windows System directory. It infects files by adding a new section named XOR at the end of the last section of the host, and it appends the virus code to the host. The Xorala virus has an infection size of 2,048 bytes. Files infected once will not be infected a second time.
The Xorala virus contains the following strings in its code. These strings can also
be found in infected files:

-= XOR 2009 Valhalla =- Assembled 1997 .. Activated 07.2002 - devoted for peace and harmony in universe against war, racism, terrorism and cruel brutality .. remember .. life is the most important thing - not money .. it's time for a revolution NOW all.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Map

Description Macro.Word.Map

The virus contains two macros: AutoClose, AutoExit. It infects the system macros area and document on closing (AutoClose). On exiting Word the virus displays the MessageBox:
Nova V tima
Voc foi v tima de MAP0997!

Macro.Word.Mark

Description Macro.Word.Mark

This is an encrypted Chinese Word macro virus. It contains five macros: A, B, AutoExec, AutoOpen, ToolsMacro (stealth). The virus replicates itself when documents are opened (AutoOpen).
Depending on the random counter the virus creates a new document and writes to there a text in Chinese. It also creates the C:X.TXT file and writes to there "0" or "1" also depending on the random counter. On next Word loading (AutoExec), if there is "1" in that file, the virus appends to the C:AUTOEXEC.BAT file the commands that formats the hard drive:
format c:/u/V:MARK>nul

Home