Virus Database

Criminal.2615

Description Criminal.2615

Criminal.2615 is a memory resident very dangerous virus. When the infected file is started the infector hits the file C:COMMAND.COM. When the virus starts from file COMMAND.COM it stays memory-resident and starts to infect other files when they are started. The infector checks the command line and if some combination (.F, .Z, .E, .D, .S) of letters present then:
displays messages like a "Criminal, be a wiseguy and turn youreself in, if you don't I will";
renames all files of current directory to CRIMINAL.xxx and then displays:
+-------------------------------------------+
¦ The Ultimate Weapon has arrived, ¦
¦ please contact the nearest police station ¦
¦ to tell about the illegal copying of you ¦
+-------------------------------------------+

It also contains the strings: ".Status", ".Enable", ".Disable", ".Force", ".Zero", "C:COMMAND.COM", "STATUS:", "CRIMINAL.000".

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Novosib.a

Description Macro.Word97.Novosib.a

This is Russian macro virus. It contains four macros:
Documents NORMAL.DOT
AutoOpen AutoOp
Fantom Fantom
Fuck FileOpen
AutoClose AutoClose

It infects the global macros area and documents on files opening. The virus contains comments and displays MessageBoxes in Russian.

Macro.Word97.Oetzi

Description Macro.Word97.Oetzi

It is a polymorphic virus. It contains eight macros in module "Modul1": AutoOpen, AutoClose, FileSaveAs, FileSave, ToolsCustomize, Mutate, Retro, Payload. It replicates on activation any of macros: AutoOpen, AutoClose, FileSaveAs, FileSave. The virus polymorphic engine inserts comments at random positions in the virus code.
The virus displays the Balloon:
Wichtig! Lesen sie folgendes genau durch:
He Bedienung! 5 Bier! Auch einen für diesen Schnapsgsicht daall. Danke!

The virus then displays the MessageBox:
W97M.Oetzi.A
Hallo, mein name ist Ötzi. Ihr könnt mich mal besuchen kommen. Für 8-9
Cuba Libre laß ich euch vielleicht gratis rein. UEO!!!
NEGSTE BUDE = 500m !!!!!!

It also erases the anti-virus files:
C:PC-Cillin 95Scan32.dll
c:pc-cil~1*.dll
C:PC-Cillin 95Lpt$vpn.*
C:PC-Cillin 97Scan32.dll
C:PC-Cillin 97Lpt$vpn.*
C:TscPC-Cillin 97Scan32.dll
c: scpc-cil~1*.dll
C:TscPC-Cillin 97Lpt$vpn.*
C:TBAVW95Tbscan.sig
c:Tbavw95Tb*.*
C:Tbavw95Tbavw95.vxd

Home