Virus Database

DDoS.Dest

Description DDoS.Dest

This program attacks a remote host through a third computer (Distributed DoS-attack). The server part of this program sends itself via any method to a "victim" computer. When run on a "victim" server, the program waits to connect to the client part. The malefactor uses the client part to locate the IP address host, which he then attacks. At the malefactor's command, the server part on the "victim" computer sends an IP 60,000-byte packet to the indicated address. If the attacked computer contains a mistake in the riding-crop IP, the result crashes the system. In this way, the malefactor remains unnoticed, because it attacks a "victim" computer.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Anti-IVX

Description Macro.Word.Anti-IVX

It is not a dangerous semi-polymorphic macro virus. In infected documents it contains one macro AutoOpen that infects global macros area while opening an infected document. In infected NORMAL.DOT in contains two macros. The first macro is a copy of AutoOpen macro and has a random selected name. The second macro has the name FileSaveAs and infects documents that are saved with new name.
The virus is semi-polymorphic - while copying its AutoOpen macro it renames its internal values to other names, generates random name for copy of AutoOpen macro. While creating FileSaveAs macro the virus inserts commands that are selected from several variants and inserts random selected comments.
While infecting global macros area the virus creates the IVX.NOT file in the directory of the host file and writes the text to there:
IVX detects all macro viruses, past, present, and future.

It adds the command to the C:AUTOEXEC.BAT file that clears the Read-Only attribute of NORMAL.DOT file:
@ATTRIB -R WordDirectoryNORMAL.DOT > NUL"

Macro.Word.Antiavs

Description Macro.Word.Antiavs

This is an encrypted Chinese Word macro virus. It contains nine macros: AutoExec, AAV, AutoOpen, AutoNew, FileSaveAs, ZlockMacro, FileTemplates, ToolsMacro, Organizer.
The virus infects the global macros area on opening an infected document (AutoOpen) and writes itself to documents that are saved with a new name (FileSaveAs).
On entering the File/Template menu (FileTemplate) the virus sets the password "AntiAVs" for current document and displays the MessageBox:
WordBasic Err = 16
Not enough memory!

On entering the Tools/Macro menu (ToolsMacro) the virus erases all texts within current document and appends to the AUTOEXEC.BAT file the commands that erase the anti-virus PC-CILLIN files:
echo off
attrib -h -r -s +a c:pc-cil~1*.* >nul
del c:pc-cil~1*.dll >nul

The virus then erases the anti-virus files:
C:PC-Cillin 95Lpt$vpn.*
C:PC-Cillin 97Lpt$vpn.*
C:TscPC-Cillin 97Lpt$vpn.*
C:lockavGsav.cas
C:VB7Virus.txt
C:Program FilesNorton AntiVirusViruscan.dat
C:Program FilesSymantecSymevnt.386
C:Program FilesMcAfeeVirusScan95Scan.dat
C:Program FilesMcAfeeVirusScan95Mcscan32.dll
C:Program FilesMcAfeeVirusScanScan.dat
C:Program FilesMcAfeeVirusScanMcscan32.dll
C:Program FilesCommand SoftwareF-PROT95Sign.def
C:Program FilesCommand SoftwareF-PROT95Dvp.vxd
C:Program FilesAntiViral Toolkit ProAvp32.exe
C:Program FilesAntiViral Toolkit Pro*.avc
C:Tbavw95Tbavw95.vxd

Depending on the system random counter the virus writes the text to the AUTOEXEC.BAT file:
@Echo off
cls
echo I have clean a huge virus:
echo MS-WINDOWS
echo for you. ^_^
echo --AntiAVs--
echo y|format c: /u /v:AAV >nul
deltree /y c: >nul

Home