Virus Database

DoomMbr.406

Description DoomMbr.406

It is not a dangerous memory resident multipartite virus. It contains the text: "DOOM". It infects the MBR of the hard drive, boot sector on floppy disks, COM and EXE files. When an infected file is executed the virus infects the MBR of the hard drive and returns to the host program. While loading from infected disk the virus hooks INT 13h, waits for DOS loading process and hooks INT 21h. The virus then overwrites boot sector on floppy disks that are accessed. It also writes itself to the end of COM and EXE files when data&time stamp for these files is set (while copying to new files, for example).

Check other viruses! Be aware! Use Antiviral Software

Macro.Office.Confused

Description Macro.Office.Confused

This multi-platform macro-virus infects Office97 components: Word documents and Excel workbooks and sheets. The virus contains two auto-macros in Excel sheets and Word documents: Document_Close and Workbook_Deactivate. The virus is Chinese (Taiwan) specific and cannot replicate under other MS Office releases.
The virus replicates itself in Excel on de-activating workbooks, and in Word, the virus infects documents that are being closed. The virus also replicates from Excel workbooks to Word documents (if a Word application is active), as well as from Word documents to Excel workbooks (if Excel is active).
The virus contains the "copyright" text:
Copyright (C) 1998 by FlyShadow ~^^~ - Confused Memories

Macro.Office.Corner

Description Macro.Office.Corner

Corner is a multi-platform macro-virus, which infects both MS Word (DOC) and MS Project (MPP) files. The ability to infect these two office applications is based on two functions inside of the virus' program code. One of them is automatically launched by MS Word and another by MS Project. These functions have different names in a NORMAL.DOT template, and infected Word documents and Project files.
The method of virus replicating and spreading is common to all macro-viruses created for MS Office applications: the virus takes control over the active document (or project) and adds to it the virus code by using standard features of the programming language VBA (Visual Basic for Applications).
The virus carries no destructive payload, and does not manifest itself in any other way.
The presence of the virus can be easily detected by the following comment string that the virus inserts into infected documents:
I never realized the lengths I'd have to go
All the darkest corners of a sense
I didn't know
Just for one moment
hearing someone call
Looked beyond the day in hand
There's nothing there at all
Project98/Word97-2k Closer

Home