Virus Database

DOS32.Daber.728

Description DOS32.Daber.728

It is DOS32 parasitic virus. It looks for DOS32 EXE files that are compiled with "Adam Seychell" DOS32 extender and infects them.
The virus looks for these files in current directory, as well as looks for two more files: C:DOSDLINK.EXE and C:DOS32DLINK.EXE
While infecting the virus parses format of that DOS32 extender header, modifies it and writes virus code to the end of the file. As a result when infected file is run virus code gets control. The virus then infects more files and returns control to the host program.
The virus does not manifest itself in any way.
The virus contains the text string:
DOS32 Succubus
Dark Fiber [NuKE]

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Satan

Description Macro.Word97.Satan

This virus contains 14 macros in one module "Satan666": Satan666, FileOpen, FileClose, FileSaveAs, FileSave, FileNew, AutoExec, AutoNew, AutoSave, AutoClose, AutoOpen, ToolsOptions, ViewVBCode, ToolsMacro. The virus infects the system and documents on calling any of these macros.
The ToolsMacro and ViewVBCode functions are available only if the first line in C:AUTOEXEC.BAT file contains the text:
REM Hail Satan!

Else the virus cancels these procedures and displays the MessageBox:
Microsoft Visual Basic
Sub or Function not defined

In June the virus erases the files and directory:
c:windows*.*
c:windowssystem*.*
c:My Documents

It then appends to the C:AUTOEXEC.BAT file the text:
@echo off
cls
echo Hail Satan!
echo Hail Satan!
echo Hail Satan!
echo Hail Satan!
echo Hail Satan!
echo Hail Satan!
echo Hail Satan!
echo Hail Satan!
echo Y>Yes
attrib -h -r -s
del *.* <Yes
end

and displays the MessageBox:
Satan666 Word97 Virus
Hail Satan!

Macro.Word97.Saturn

Description Macro.Word97.Saturn

This macro virus contains eight macros in one module "Saturn": AutoOpen, AutoClose, Stealth, ToolsMacro, ToolsCustomize, ViewVBCode, Saturn, UMP.
The virus infects the global macros area on opening an infected document (AutoOpen). Other documents get infection on their opening and closing. While infecting the virus turn off the Word virus protection (the VirusProtection option). Depending on the system date and random counter the virus changes the computer's name to "SOS" and set on document the password "SOSxxx", where "xxx" is a number from 1 to 333. On entering the menu Tools/Macro, Tools/Customize or opening Visual Basic Editor it displays one of the following messages:
Not enough memory to perform this operation
Impossible open this function
Function does not answer system requests
This program has performed an illegal operation and will be locked
This option at present not available

The virus then swaps reaction on mouse buttons and closes all documents.

Home