Virus Database

Woytek.1656

Description Woytek.1656

It is not a dangerous memory resident parasitic polymorphic virus. It hooks INT 21h and writes itself to the end of EXE files that are accessed. The virus does not infect files that have the "Marek Sell" string near the header. In case of errors while infecting a file the virus creates the DIRINFO file in the current directory and writes to there one of the strings:
Who is MR GUZEK ?
MR GUZEK was here
MR GUZEK is alive
MR GUZEK ForEver!
Immortal MR GUZEK

The virus also contains the text strings:
BioTech I, The Digital Form of Life
(c) by Woytek W. Lodz, 28 Nov 1996

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Gas

Description Macro.Word.Gas

This virus contains macros:
Documents NORMAL.DOT
AutoOpen GAS
I R, AutoClose, FileTemplates, ToolsMacro, Autoexec
A S, FileSaveAs

Depending on the current date it inserts into C:AUTOEXEC.BAT the commands:
BREAK OFF
If exist C:GAS.BAT call GAS.BAT
BREAK ON

To the C:GAS.BAT file the virus writes the commands that delete the *.JPG, *.GIF, *.BMP files on the C: drive, including subdirectories. Depending on current seconds the virus outputs the string to the statusline :
A s s a l a m u a l a i k u m

Macro.Word.Gavin

Description Macro.Word.Gavin

This is an encrypted macro virus. It contains only one macro named in FileSave in NORMAL.DOT and AutoOpen in documents. The virus infects the global macros area on opening an infected document and infects documents when they are saved.
On infecting global macros area (NORMAL.DOT) the virus saves current date in the CONTROL.INI file in [MS-Word] section, line "Compatibility". In 28 days the virus inserts the auto-correction: "Microsoft" -> "Microbollocks".
The virus contains the comments:
Gavin's Word Virus V2.0 - 1996
Platform Independant
*** NOT FOR RELEASE ***
In emergency contact gr.brock@ic.ac.uk

Home