Virus Database

Witch Family

Description Witch Family

These are dangerous not memory resident encrypted viruses. They search for .EXE-files and write themselves to their ends. The viruses delete the files, they contain the text string:
*.eXe dOs ChKdSk.exE XcOPy.eXE MeM.ExE cHkLiS*.*

Depending of the system date and their internal counters the viruses display the messages and halt the computer:
IT'S WITCHING HOURall YOUR COMPUTER IS BEING HAUNTED ! HAHAHA...
Bad luck... You've got a virus in your system !
Think about using a virus-scanner which is more up-to-date !
Here lies a program in its coffin, executed by a user one time too often...

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Desecration

Description Macro.Word97.Desecration

This is Chinese (Taiwan) specific macro virus contains five macros in one module "Desecration": AutoOpen, FileSave, FileNew, FileOpen, Desecration.
The virus infects the global macros area on opening an infected document (AutoOpen). Other documents get infection on their open, creating and saving (FileOpen, FileNew, FileSave).
The virus does not manifest itself in any way. The code of virus contains the comment:
Desecration By RUiNER /Sign Of Scream

Macro.Word97.Dig

Description Macro.Word97.Dig
Dig is a stealth macro virus. It contains the following macros:
AutoOpen, AutoExec, FileSave, FileSaveAs, ToolsOptions, ToolsMacro, ViewVBCode.

When an infected file is opened the virus disables the VirusProtection and DisableAutoMacros security options. The virus infects documents while they are opened, closed, or saved with alternative names (AutoOpen, FileClose, FileSaveAs).
The virus hides its body while Tools/Macro or File/Templates menu items are invoked.
If the user tries to view the macros source code, the virus calls the FatalAppExit system function and displays the following message:
"?R?Ç'Í WinWord ?Ì? ' Ä × 'Í-ÇÏ Rɳ??Ç ?Á³ ?ÌR?? VBA! Code : dd!Actor"
If the current hour and minute values match (for example, 8:08) while the virus is infecting a document, it creates a new auto-format rule that replaces "," with ", ?'³-," and shows a message box with the following text:
Copyright c 1999 by dd!Actor.
All rights reserved.

Home