Virus Database

XXX.1060

Description XXX.1060

It is a very dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the beginning of .COM files that are accessed by DOS functions FindNext FCB and ASCII. The virus corrupts the files of small length. On 19th of any month it formats disk sectors and displays the message:
My dear xxx:
Happy birthday and happy a new year !
Yours xxx .

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Inexist

Description Macro.Word.Inexist

This is a French macro virus, it contains three macros: AutoOpen, FichierEnregistrer, FichierEnregistrerSous. On opening an infected document the virus infects the global macros area and all "AddIn"s. The virus infects documents on their saving. The virus does not manifest itself in any way.

Macro.Word.Inlay

Description Macro.Word.Inlay

This is a German-specific Word macro virus. It contains eleven macros: InnLib, FileOpen, FileSave, HilfeInfo, Innocence(AutoOpen), FileSaveAs, ToolsMacro, DateiOffnen, DateiSpeichern, DateiSpeichernUnter, ExtrasMakro.
All infection routines are placed in InnLib macro, all other macros call InnLib for necessary routines.
On opening a document the virus checks it for the macro viruses:
Atom Boom:De Buero:De Cap:De Clock:De Colors Concept Darkside Friday:De
Gangsterz Hot Imposter Lazy NF NomVir:De Friends:De Nuclear Nop:De Pheew
Spooky:De Stryx Target Tele Wazzu Zero:De Xenixos:De Outlaw

If any virus is found, the "Inlay" virus displays the MessageBox:
Innocence meldet:
Die Datei <FileName> enth lt einen Makrovirus .
Identifiziert als: <VirName>
KEINE PANIK:
Innocence wird nun versuchen, diesen Virus zu entfernen.
Ihr Dokument wird nicht besch digt.

The "Inlay" virus calculates the number of detected viruses in the WIN.INI file in the section "[Intl]" in string "Killed". In string " "Inlay" it keeps the month of latest infection. The virus also creates the INLAY file which adds to the NORMAL.DOT and registers in the "pfad" string.
On entering the Tools/Macro menu the virus saves "backup" of the current document to the NORMAL.DOC, removes all its macros and loads original not infected file

Home