Virus Database

DW.736

Description DW.736

It is not a dangerous memory resident parasitic virus. It hooks INT 9, 21h and writes itself to the end of COM and EXE files that are opened. By hooking INT 9 (keyboard) the virus intercepts the "DW" input and stuffs the following text into the keyboard buffer :
Dream Warriors

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Christy

Description Macro.Word97.Christy

This Word97 macro virus contains 11 macros in one module "Christy": AutoClose, AutoOpen, FileSaveAs, FileTemplates, ToolsMacro, Mutate, ChristyPayload, Retro, ToolsCustomize, ToolsOptions, ViewVBCode.
While installing into the system the virus switches off the VirusProtection option. The virus infects documents on opening and closing (AutoOpen, AutoClose, FileSaveAs), saving them with a new name .
When the Tools/Macro menu is entered, the virus displays the MessageBox:
Microsoft Word
This program has performed an illegal operation and will be shut down.

On saving documents the virus erases the anti-virus data files and programs:
C:PC-Cillin 95Scan32.dll
c:pc-cil~1*.dll
C:PC-Cillin 95Lpt$vpn.*
C:PC-Cillin 97Scan32.dll
C:PC-Cillin 97Lpt$vpn.*
C:TscPC-Cillin 97Scan32.dll
c: scpc-cil~1*.dll
C:TscPC-Cillin 97Lpt$vpn.*
C:lockavGsav.dat
C:lockavGsav.cas
C:Program FilesNorton AntiVirusViruscan.dat
C:progra~1 orton~1viruscan.dat
C:Program FilesSymantecSymevnt.386
C:progra~1symantecsymevnt.386
C:Program FilesMcAfeeVirusScan95Scan.dat
C:progra~1mcafeeviruss~1scan.dat
C:Program FilesMcAfeeVirusScan95Mcscan32.dll
C:progra~1mcafeeviruss~1mcscan32.dll
C:Program FilesMcAfeeVirusScanScan.dat
C:Program FilesMcAfeeVirusScanMcscan32.dll
C:Program FilesCommand SoftwareF-PROT95Sign.def
C:progra~1comman~1f-prot95sign.def
C:Program FilesCommand SoftwareF-PROT95Dvp.vxd
C:progra~1comman~1f-prot95dvp.vxd
C:Program FilesAntiViral Toolkit ProAvp32.exe
C:progra~1Antivi~1Avp32.exe
C:Program FilesAntiViral Toolkit Pro*.avc
C:progra~1antivi~1*.avc
C:TBAVW95Tbscan.sig
c:Tbavw95Tb*.*
C:Tbavw95Tbavw95.vxd
C:f-macrof-macro.exe
C:f-prot~1f-prot.exe

Macro.Word97.Cipher

Description Macro.Word97.Cipher
The virus contains seven macros in one module "Cipher": AutoNew, AutoOpen, AutoClose, cphrdoc, hideb, WindowsDirectory, and spreadIB. It replicates upon document creating, opening and closing (AutoNew, AutoOpen, AutoClose).
Depending on the system random counter, the virus sets the password "MisterCipher" on a current document or displays the following MessageBox:
Time Signal
I say to you that it's
It's too late. You must finish to work before next time!!!
Bye,Bye

On Friday the 17th, on the 31st of the month (excluding those with less days), and on the 25th of April, the virus drops a file infected by the the "Italian.578" DOS virus.
Upon closing documents on the 25th of April, or depending on the system random counter, the virus encrypts the text in the current document and displays the following MessageBox:
I want to say to you: L'Italia una ed indivisibile e c' la morte per
chi la divide!!!!!all..
Are you angry because you lost your document?+; Kill Bossi, the fault is his
Mister Cipher reigning

Home