Virus Database

Devore.370

Description Devore.370

It is a harmless nonmemory resident parasitic virus. It searches for COM files, then writes itself to the end of the file. The virus does not manifest itself in any way, it contains the text string:
> Age of Loneliness - DeVore 1997 <

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Uglykid

Description Macro.Word.Uglykid

This is a polymorphic Word macro virus. It contains one macro in documents: AutoOpen, and two macros in NORMAL.DOT: FileSave, ToolsMacro. The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are saved (FileSave).
The virus uses quite complex polymorphic engine - different infected files have variable sets of commands in virus' macros. The virus also uses quite complex way to hide its main code in documents and templates: the main virus code is placed in AutoText area and virus' macros just read it from there, copy the text to macros area and execute it. This is the first known virus that uses such way to hide itself.
The virus sets the user's name to "Nasty". The polymorphic engine has bugs, as a result it may produce corrupted code.

Macro.Word.Uhrjap family

Description Macro.Word.Uhrjap family

These macro viruses contain different number of macros:
"Uhrjap.a": one, DelNew, autoopen, autoclose, normclose
"Uhrjap.b": Eee, autoclose, ToolsMacro, FileTemplates, ToolsCustomize,
Oao, autoopen.

They infect the global macros area on opening an infected document. Other documents get infection on closing.
"Uhrjap.b" is the stealth virus: on entering the Tools/Macro, Tools/Customize or File/Templates menus the virus removes its macros from a document, and as a result its code is not visible in macro viewing menus.
The viruses have destructive payload. "Uhrjap.a" on each 20'th opening starts a procedure that every 10 minutes counts the characters in the document. If the count it the same (haven't changes during 10 minutes), the virus renames all files in the root directory and first level directories on the C:, D: and E: drives with the names "~TLPxxx.TMP", where "xxx" is ordinal number of file in a directory. The virus also runs this renaming procedure with probability 2% on any document opening.
The "Uhrjap.b" virus on document opening or closing with probability 1/30 saves document with new password "uhrjap-uhrjap", or prints document, or deletes from document all space characters and replaces all digits with the "#" character. It also with probability 1/50 activates its payload procedure that is similar with "Uhrjap.a" virus: it renames all files in the root directory and first level directories on the C:, D: and E: drives with the name "~037xxx.TMP" where "xxx" is ordinal number of file in a directory.

Home