Virus Database

Win95.Vip.4299

Description Win95.Vip.4299

It is a dangerous nonmemory resident parasitic Win95 virus. It searches and infects PE EXE files in the current directory, then in Windows directory, then in root directories on C: and A: drives, and in random selected subdirectories on C: and A: drives. The virus infects up to two files in each directory on each run. While infecting the virus creates new section with ".TechnoK" name at the end of the file, and writes its code to there.
The virus checks file names and does not infect the files: WININIT.EXE, EXPLORER.EXE, DOSREP.EXE, TASKMON.EXE.
To access Windows functions to search and infect files the virus uses two sets of hard-coded addresses that are valid only under standard Win95 and Win98 editions.
On 12th of any month the virus tries to erase random selected disk sectors, but uses DOS standard of the direct write call, and as a result will definitely cause "General Protection Fault" Windows error message.
The virus contains the text strings:
ViruS "SABOTAGIO" CrEaTed by Techno KnightS - Italy.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Frenzy

Description Macro.Word97.Frenzy

This macro virus contains one macro Frenzy. This macro contains auto-function AutoOpen and infects the system and documents on files opening.
The virus disables the AutoProtection. Depending on the system date and system random counter the virus displays the text:
Attention:
Word97.Frenzy by Pyro [VBB]

On random selected time the virus sets to current document the password "Frenzy". If the length of document is 25 symbols or above, the virus deletes random selected letter.

Macro.Word97.Furi

Description Macro.Word97.Furi

This macro-virus infects Microsoft Word documents. It disables Word's internal anti-virus protection and changes the registered Windows owner name to "The WalruS". Upon document closing, depending on the system time, the virus may change a document's background to blue and show a Notepad window that appears as follows:

The documents background may be restored to white by unchecking the checkbox as follows:
Tools->Options->General->"[ ] Blue background, white text"
Upon document printing, the virus, depending on the system time, may insert into the document text the following:
Please Select Help About For More Information!
Upon clicking on the menu Help->About, the virus displays its own dialogue box with the following text:
Welcome To The Furio Virus By The Walrus

Home