Virus Database

Cd.2161

Description Cd.2161

It's a memory resident not dangerous encrypted virus which hooks INT 21h and infects by standard way COM- and EXE-files. It contains the text string: "SCAN CLEAN VIR ARJ FLU COMMAND". The virus doesn't infect these files. It also contains the strings ".COM.EXE" and sometimes types:
VirCheck V1.2 (C)1991
Be aware of those worms out there, violating
your machine on Friday 13th - it's tomorrow!
Special thanks to Ross M. Greenberg,
Patricia M. Hoffmann and John McAfee
Press any key to continueall

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Niki

Description Macro.Word.Niki

This encrypted virus contains six macros: AutoExec, AutoOpen, FileApri, FileSalvaConNome, StrumMacro, NiKI. The virus infects the global area on AutoOpen and writes itself to the documents on FileApri (FileOpen?) and on FileSalvaConNome (FileSaveAs?).
The virus in some way modifies the Tools/Customize menu. Depending on the system time it runs its trigger routine (macro NiKi) that in some way modifies the current document and deletes *.DOC and *.DLL files in C:MSOFFICE and C:WINDOWSSYSTEM directories.

Macro.Word.Niknat.i

Description Macro.Word.Niknat.i

This encrypted macro virus contains four macros, it replicates on closing documents (AutoClose):
Documents NORMAL.DOT
EvaHzg EvaHzg
AutoClose DCloseAN
FileTemplates FileTemplates, ToolsMacro
TCloseAN AutoClose

On October 23 the virus creates the EVAH.BMP file with a porno-picture image inside in the Windows directory and sets it as the Windows background picture (wallpaper). The virus then also changes Windows color palette.
On entering the File/Templates and Tools/Macro Word menus the virus displays the MessageBox (stealth):
Microsoft Windows
Windows Protection Errorr

The virus also contains the comments, these comments depend on the virus version:
"Niknat.a,b,all":
by NAENBGOURSG
SO.HT.AI.KS
231076-GREECE
Thanks to NEURO
VRD 19-4-1997
VRP A.U.A (+.+.+)

"Niknat.i":
--------------------------------
Latin word -virus- means poison and is a derivative
of two Sanskritic roots --> -vishas->(poison)
and -ishus->(arrow).
NAENBGOURSG - SO.HT.AI.KS
M.SC. in MacroViral Science
---------------------------------

Home