Virus Database

Cascade.691

Description Cascade.691

This is a memory resident virus. Its body except for the beginning (first 32 bytes) is encoded. As a key the length of the infected file is used. That is why two strains of the same virus in most cases will coincide only in the first 32 bytes.
As an infected program is executed, the control of the JMP command is transferred to the beginning of the virus. By first commands the virus determines the length of the source file and deciphers its body.
On creating its memory-resident copy the virus:
copies its body into the highest addresses of the memory;
moves the body of the main program into the highest addresses of the memory;
moves the virus body into cleared area above the main program body;
sets INT 1Ch, 21h, 28h to its own copy.
ƒ all ƒ ƒ ... ƒ ƒ ... ƒ ƒ ... ƒ
+---------ƒ +---------ƒ +---------ƒ +---------ƒ
ƒProgram ƒ ƒProgram ƒ--+ ƒFree ƒ +-->ƒVirus ƒ
ƒ ƒ ƒ ƒ ƒ ƒmemory ƒ ƒ ƒ ƒ
ƒ ƒ ƒ ƒ ƒ +---------ƒ ƒ +---------ƒ
+---------ƒ +---------ƒ +-->ƒProgram ƒ ƒ ƒProgram ƒ
ƒVirus ƒ--+ ƒVirus ƒ ƒ ƒ ƒ ƒ ƒ
ƒ ƒ ƒ ƒ ƒ ƒ ƒ ƒ ƒ ƒ
+---------ƒ ƒ +---------ƒ +---------ƒ ƒ +---------ƒ
ƒ ... ƒ +-->ƒVirus ƒ ƒVirus ƒ--+ ƒ ... ƒ
ƒ(copy) ƒ ƒ ƒ
+---------ƒ +---------ƒ
ƒ ... ƒ ƒ ... ƒ

The virus affects only COM files as it's loaded into the memory for execution. Infection is carried out by standard method. Most widely spread versions of this virus does not reinfect files.
The virus changes interrupt vectors 1Ch, 21h and 28h. It also produces a specific video-effect: crumbling down of letters on the screen; does not have destructive functions.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Wmvh

Description Macro.Word.Wmvh

This virus contains two macros in documents (AutoOpen, BieDEMO) and five macros in NORMAL.DOT (AutoNew, AutoOpen, AutoExec, AutoClose, BieDEMO).
It infects the global macros area on opening an infected document (AutoOpen). The documents get infection on AutoNew, AutoOpen, AutoClose.
On October 10th the virus displays the MessageBox:
BieDEMO Macro Virus by WMVH
This is a Demo of Bie's WMVH

The virus contains the comments:
REM Bie's Word Macro Virus Hamburger Ver.beta
REM This Macro Virus Made from Bie's WMVH
REM Bie's E-Mail: bie111@hotmail.com
REM 2/09/1997

Macro.Word.Wompie

Description Macro.Word.Wompie

This virus contains six macros: autoexec, autoopen, FileSave, FileSaveAll, one, Wompie. It infects the system macros area and documents on opening (AutoOpen) and saving (FileSave). The virus deletes menu items File/Templates and Tools/Macro. It contains commented text:
The United Hackers of Amsterdam Presents the Wombat1 or Wompie Created
by The Wombat

Home