Virus Database

Devastator.301

Description Devastator.301

This is a dangerous non-memory resident encrypted virus. It contains the text strings:
*.COM Devastator XI
Now includes destructor code!
1994 / 12-21-94
This is overwriting virus. It searches for COM files and overwrites them. On May 26th it erases the disk sectors.

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Ochoy

Description Macro.Word.Ochoy

This is an encrypted macro virus containing five macros in infected documents and ten macros in global macros area (NORMAL.DOT):
Documents NORMAL.DOT
Ard01, AutoOpen Ard01
Ard02 Ard02, FileSave, AutoClose
Ard03 Ard03, FileTemplates, ToolsMacro, ToolsCustomize
Ard04 Ard04, FileOpen

It infects the global macros area on opening an infected document (AutoOpen) and copies itself to documents that are saved or closed (FileSave, AutoClose). Before infecting the virus deletes all macros in target. The virus stores the counter of infections in document's variable "ard01". Depending on this counter the virus either prints to the status line the text "O C H O Y * P K T B N I", or displays the MessageBox:
BNI - PKT
(c) Ardi Sunardi - 1 9 9 7

Macro.Word.Ofxx

Description Macro.Word.Ofxx

This is an encrypted virus containing three macros that have different names in global area (NORMAL.DOT) and infected documents:
NORMAL.DOT Infected files
Macro1 Ofxx AutoOpen - infects the global area on opening
Macro2 AutoClose Cfxx - infects the files on closing
Macro3 AutoExec Show - corrupted in samples I have

In most samples macro "AutoExec" ("Show") is damaged, but virus code is able to replicate itself without problems ever with damaged macro. The damaged macro contains following text:
at yang kaya dengan uap air bali yang berada di direktori WINDOWS
dan WINWORD telah hilang, jangan kaget, ini bukan ulah Anda, tapi
ini hasil pekerjaan sayaallBarang siapa yang berhasil menemukan
cara menangkal virus ini, saya aka j¡n memberi listing virus ini
untuk Anda !!! Dan tentu saja saya akan terus datang kesini untuk
memberi Anda salam dengan virus-virus terbaru dari saya...selamat !
Bandung,
C:PESAN.TXT

This text is very similar to the text included in the "Macro.Word.Bandung" virus.

Home