home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Monster Media 1996 #15
/
Monster Media Number 15 (Monster Media)(July 1996).ISO
/
virus
/
fwin311e.zip
/
KNOWN.TXT
< prev
next >
Wrap
Text File
|
1996-06-16
|
8KB
|
248 lines
The messages that F/WIN 3.11 produces for the various KNOWN macro
viruses and trojans appear below. If the infected file has a .DOC file
extension, an additional message will be produced that says:
- Contains macros but is named .DOC
WordMacro.Boom
==============
- Contains 4 macros (2863 bytes)
- Contains macros but is named .DOC
- System macros: AUTOOPEN, AUTOEXEC, FILESAVEAS
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses 'Organize .Copy' to copy macros
- Uses the 'FileSaveAs' macro command
- Disables NORMAL.DOT write access warnings
- Enables the quick save option
Seems to be infected with a macro virus!
WordMacro.Colors
================
- Contains 9 macros (6470 bytes)
- System macros: AUTOOPEN, AUTOCLOSE, AUTOEXEC, FILEEXIT, FILESAVE,
FILESAVEAS, FILENEW, TOOLSMACRO
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
- Reenables auto macro processing
- Disables NORMAL.DOT write access warnings
Seems to be infected with a macro virus!
WordMacro.Concept
=================
- Contains 4 macros (1968 bytes)
- System macros: AUTOOPEN
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
Seems to be infected with a macro virus!
WordMacro.Date
==============
- Contains 1 macro (1042 bytes)
- Contains macros but is named .DOC
- System macros: AUTOOPEN
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses 'Organize .Copy' to copy macros
- Uses the 'FileSaveAs' macro command
- Disables NORMAL.DOT write access warnings
Seems to be infected with a macro virus!
WordMacro.Devina
================
- Contains 1 macro (2357 bytes)
- Contains macros but is named .DOC
- System macros: AUTOCLOSE
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses 'Organize .Copy' to copy macros
- Uses the 'FileSaveAs' macro command
Seems to be infected with a macro virus!
WordMacro.DMV
=============
- Contains 1 macro (3002 bytes)
- System macros: AUTOCLOSE
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
Seems to be infected with a macro virus!
WordMacro.Doggie
================
- Contains 3 macros (610 bytes)
- Contains macros but is named .DOC
- System macros: AUTOOPEN, FILESAVEAS
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
Seems to be infected with a macro virus!
Winword.Trojan.FormatC
======================
- Contains 1 macro (81 bytes)
- System macros: AUTOOPEN
- Contains execute-only macros (encrypted macros)
- Execute other DOS or Windows programs! (Shell)
Seems to contain a trojan macro!
WordMacro.Guess
===============
- Contains 1 macro (1126 bytes)
- Contains macros but is named .DOC
- System macros: AUTOOPEN
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
Seems to be infected with a macro virus!
WordMacro.Hot
=============
- Contains 4 macros (5515 bytes)
- System macros: AUTOOPEN
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
Seems to be infected with a macro virus!
WordMacro.Imposter
==================
- Contains 2 macros (907 bytes)
- System macros: AUTOCLOSE
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
Seems to be infected with a macro virus!
WordMacro.KillDLL
=================
- Contains 1 macro (284 bytes)
- Contains macros but is named .DOC
- System macros: AUTOOPEN
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
- Deletes other files! (Kill)
Seems to be infected with a macro virus!
WordMacro.LBYNJ
===============
- Contains 7 macros (22256 bytes)
- System macros: AUTOOPEN, AUTOEXEC, FILEEXIT, FILEOPEN, FILENEW
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
- Execute other DOS or Windows programs! (Shell)
- Writes into other files directly (Write)
- Reenables auto macro processing
Seems to be infected with a macro virus!
WordMacro.Nuclear
=================
- Contains 8 macros (10712 bytes)
- System macros: AUTOOPEN, AUTOEXEC, FILEEXIT, FILESAVEAS
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
- Execute other DOS or Windows programs! (Shell)
- Writes into other files directly (Write)
- Deletes other files! (Kill)
- Disables NORMAL.DOT write access warnings
- Changes DOS attributes of other files
Seems to be infected with a macro virus!
WordMacro.Wazzu
===============
- Contains 1 macro (644 bytes)
- System macros: AUTOOPEN
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
Seems to be infected with a macro virus!
WordMacro.Xenios
================
- Contains 11 macros (31342 bytes)
- System macros: AUTOOPEN, AUTOEXEC, FILEEXIT, FILESAVE, FILEOPEN,
FILESAVEAS, TOOLSMACRO
- Contains execute-only macros (encrypted macros)
- Copy macros into the global template ('CopyMacro')
- Uses the 'FileSaveAs' macro command
- Execute other DOS or Windows programs! (Shell)
- Writes into other files directly (Write)
- Reenables auto macro processing
- Disables NORMAL.DOT write access warnings
- Changes DOS attributes of other files
Seems to be infected with a macro virus!
Here's a quick-reference chart sorted in the following order:
1st - by number of macros F/WIN found
2nd - by how many bytes all the macros utilize
Virus Name Nbr Macros/Bytes
---------- ----------------
Winword.KillDLL Contains 1 macro (284 bytes)
Winword.Wazzu Contains 1 macro (644 bytes)
Winword.Date Contains 1 macro (1042 bytes)
Winword.Guess Contains 1 macro (1126 bytes)
Winword.Devina Contains 1 macro (2357 bytes)
Winword.Imposter Contains 2 macros (907 bytes)
Winword.Doggie Contains 3 macros (610 bytes)
Winword.Atom Contains 4 macros (1029 bytes)
Winword.Concept Contains 4 macros (1968 bytes)
Winword.Boom Contains 4 macros (2863 bytes)
Winword.Hot Contains 4 macros (5515 bytes)
Winword.Colors Contains 9 macros (6470 bytes)
Winword.Nuclear Contains 9 macros (10556 bytes)
Winword.Xenios Contains 11 macros (31342 bytes)
If the infected Word template contained macros in it before
it was infected, then some of those original harmless macros
could still be present. In that case, the counts above
would not match the counts you'd normally see for each
particular virus. For instance, if a template contained 2
macros totaling 1000 bytes before being infected with the
Concept virus, F/WIN's count would include those original
macros plus those that were copied into the file by the
Concept virus. So in this example, F/WIN might produce the
following line for Concept:
- Contains 6 macros (2968 bytes)