|
|
Macro.Word.Purita Viruses Information
| Name: |
Macro.Word.Purita |
| Category: |
Viruses |
| Description:
|
Details
Macro.Word.Puritan
This is a dangerous macro virus. In infects documents and global macros area (NORMAL.DOT). There are six virus macros, but there are only five different ones:
Document NORMAL.DOT
Macro1 Puritan Puritan
Macro2 Rtr Retro
Macro3 FSAB FileSaveAs
FSAB
Macro4 AOB AOB
AutoOpen
Macro5 ToolsMacro ToolsMacro
The virus infects global macros area on AutoOpen and documents on FileSaveAs. The virus deletes the anti-virus files, if they exist:
C:Program FilesNorton AntiVirusVirscan.Dat
C:Program FilesF-Prot95Fpwm32.dll
C:Program FilesMcAfeeScan.dat
C:Tbavw95Tbscan.sig
It also appends to the end of AUTOEXEC.BAT file the commands that also delete these files:
@echo off
IF exist C:Program FilesNorton AntiVirusVirscan.Dat
then del C:Program FilesNorton AntiVirusVirscan.Dat
IF exist C:Program FilesF-Prot95Fpwm32.dll
then del C:Program FilesF-Prot95Fpwm32.dll
IF exist C:Program FilesMcAfeeScan.dat
then del C:Program FilesMcAfeeScan.dat
IF exist C:Tbavw95Tbscan.sig
then del C:Tbavw95Tbscan.sig
On accessing Tools/Macro menu the virus displays the MessageBox with the strings:
Out of memory.
WordBasic Err = 7
The virus contains the comments in the Puritan macro:
The Style of macro virii was invented by
those with an Open mindall
If you have an Open mind To other influences
you will grow out as one of the best...
'Poet of the highest quality ;-) from
'--- Neophyte ---- |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Win32.Doser.418
Macro.Word.Dodge
3tunes.178
Goblin.175
VCC.40
Macro.Word97.Jacka
Chad Famil
HDKille
I-Worm.Gibe.
Arcv.33
|
|
