Virus Database

Worm.Win32.Busan

Description Worm.Win32.Busan
The Busan worm spreads through networks by copying itself to all accessible network resources. The worm is a Windows application (PE EXE-file) that is compressed with UPX and has a size 14KB. Its code is written in the C ++ programming language.
When run the worm sends out a message via ICQ to UIN the author, and then proceeds to copy itself to the Windows directory under the name files32.sys. The Busan worm also copies to the Windows directory a file named mh32.dll which is a keyboard 'interceptor'. Then the worm tries to copy itself under the name auto.exe to the following directories:
C:WINDOWSAll UsersStart MenuProgram FilesStartUp C:WINDOWSAll Users?' ?-R? ?-Ï?ÁR?Á Ì??×R ?ÁÇ?
Because of a mistake in its code it fails to successfully copy itself to the above directories. Busan then probes IP-addresses and copies itself to all accessible network resources.
Next the worm registers itself in the system registry key:
[HKEY_CLASSES_ROOTexefileshellopencommand]
@="files32.sys "%1" %*"

This entry causes the worm to be run anew each time any EXE-file is opened.
While running the worm collects all accessible names and passwords to the mail boxes registered in the system and stores them in the C:WINDOWSlmhost.log file. After this is done Busan tries to send this file to the malefactor (worm's master). The same file contains a complete record of keyboard strokes recorded by the keyboard interceptor represented by the file mh32.dll.
The Busan worm tries to download a file named worm31.bmp from an Internet web-site but cannot as the page has since been removed.

Check other viruses! Be aware! Use Antiviral Software

Constructor.Macro.Word97.Nightmare

Description Constructor.Macro.Word97.Nightmare

Text (c) Michal A. Egler
This is a macro word utility for creating Macro.Word viruses. It contains the macros: DAT1, DAT2, DAT3, DAT4, DAT5, DAT6, DAT7, DAT8, DAT9, DAT10, DAT11, DAT12, DAT13, DAT14, DAT15, DAT16, DAT17, DAT18, AutoExec, and AutoOpen.
Nightmare Jokes Word Macro Virus Construction Kit
:-()
Dieses Programm ist zu reinen Lehrnzwecken entstanden.
Die Verantwortung für jeglichen entstandenen Schaden,
der durch dieses Programm verursacht wurde, liegt bei
dem Anwender!
PEACE /

This consttructor can create macro viruses containing the following ten virus droppers:
1 = Casino Virus - Casino.2330
2 = Media Markt Virus - VCL.Markt.1533
3 = MTE.Shocker - MtE.Shocker
4 = Sirius.Alive - Sirius.Alive.4608
5 = SMEG.Queeg - Smeg
6 = Tequila - Tequila
7 = Virogen - VICE.05.Code.3952
8 = Uniform [Boot Virus] - Uniform
9 = Bizatch/Vlad - Win95.Boza.c.(intended)
10 = Tremor - Tremor

The virus can append text and input during creation at the end of printed documents.

Constructor.Macro.Word97.Nightmare

Description Constructor.Macro.Word97.Nightmare

The Demolition Kit is another Word macro virus creation kit. It can create macro viruses and macro word trojan horses. This tool exists in several versions.
The original Demolition Kit is packed together with three sample Macro.Word viruses: Blackk, Blackend, Grunt.

Home