Copyright: NVLR is copyright by NoMercy 1997-1998


NoMercy Virus Labs. Report

visit NoMercy Page

http://www.geocities.com/ResearchTriangle/3996

Please check any document before you open that document, don't believe with your own document, who know your document was infected!. (Prevent first, Mad later! :)

Introduction

Note from the author

Labs. Report

This list is order by original name, for detail you can see by your self !

WM. Anak SMU

WM. Andry Christian

WM. Bandung

WM. Birthday

WM. Brotherhood of NOD Unscan!

WM. Bukit Asam

WM. Chicken Pox

WM. Dzutaqshiri

WM. Etna Unscan!

WM. Foxz

WM. Krakatau

WM. Junkies

WM. Junkies Update

WM. Junkies 02

WM. Npad.xx

WM. NoMercy

WM. NoMercy II

WM. Ono We

WM. Phardera.xx

WM. Ririn

WM. Rapi.xx

WM. TenFaces

WM. TenFaces II

WM. Toegoe

WM. Strezz

WM. Surabaya

WM. Vampire

WM. Victor Widjaja

WM. Visit

WM. VisuaLand

Distribution

Aurodreph Cattle

Cicatrix Site

NoMercy Online

Dedicate and thanks

Dedicate

Thanks


Introduction

Welcome to NVLR (NoMercy Virus Labs. Report),

I'm Foxz the one of virus maker from NoMercy try to help you to know WHAT,  WHEN, and HOW macro virus from Indonesia attack your document.

This report is Free!!, PURE Free!!, I just need your comment, bad or good just say  your comment in NoMercy GuestBook or fill COMMENT.CMT and send it to me. Truly I like to hear your comment.

If you feel this can help your friend please let your friend know! " remember not for money ", don't keep this secret for your self (be a Gentleman).

IMPORTANT!!

If you get this file by buy from somebody or company,  please contact me !, or let me know who that guys !. For you know, I make this report without payment!, and no one can sell this file !!

May be a new virus not include in this report, if you want see the newest report visit NoMercy Page!

If you suspect your document was infected by a virus please send it to NoMercy, Cicatrix or Aurodreph first then send it to your favorite AVers :)

  Foxz,

 (One of NoMercy Founder)

foxz_nomercy@hotmail.com


Foxz
with CrazyMan founded small virus group called NoMercy


NoMercy
NoMercy WEB PAGE

URL = http://www.geocities.com/ResearchTriangle/3996

email = nomercy12@hotmail.com


Author
Note from the Author

Hey, My name is Foxz, I'm one of NoMercy Founder.

I make this NVLR cause I think you need to know WHAT,  WHEN, and HOW macro virus from Indonesia attack your documents. Why I do this?,.. cause I'm a virus maker, my good side and my dark side is balance, when the bad side win, I make a virus, but when my good side win I do a good thing (i.e.: like this).

In this version, I only analyze Indonesian Macro Virus only, if you wanna pay me, may I can make analyze International Macro Virus, or just wait my good side totally win (impossible!).

Like make CVCK, over than 100 cigarettes and 50 cups of coffee to finish this NVL.R Can anybody help me to stop smoking?.

I'm Sorry if my English is not good, cause I'm a Indonesian boy.

If you think this file is great please let me know by fill NoMercy  Guestbook or fill COMMENT.CMT and send it to me.

If you feel this can be distribute, distribute its!, but remember, not for sale! Just distribute its for free.

REMEMBER !

Check any document before you open that document, don't believe with your own document, who know your document was infected!.

_________

Back to content


Cicatrix
Cicatrix Site

URL = http://www.geocities.com/~cicatrix

email = cicatrix@usa.net


Aurodreph
Aurodreph Cattle

URL = http://www.ilf.net/AURODREPH/virus.htm

email = aurodreph@defiant.ilf.net


WM. Anak.SMU
WM. Anak SMU

Original Name	:	Anak SMU
Scanned as	:	Anak.A
Origin	:	Semarang, Central Java
Author	:	Anak SMU
Variant	:	Not Yet Found
Organization/Group	:	Not yet Analize, I don't have sample for analize, all I know this virus is created by Anak SMU Semarang, if you have sample please send to me !
Stealth	:	Not yet Analize, I don't have sample for analize, all I know this virus is created by Anak SMU Semarang, if you have sample please send to me !
Active	:	Not yet Analize, I don't have sample for analize, all I know this virus is created by Anak SMU Semarang, if you have sample please send to me !
Macro in Document	:	Not yet Analize, I don't have sample for analize, all I know this virus is created by Anak SMU Semarang, if you have sample please send to me !
Macro in Normal	:	Not yet Analize, I don't have sample for analize, all I know this virus is created by Anak SMU Semarang, if you have sample please send to me !
May I checking macro ?	:	Not yet Analize, I don't have sample for analize, all I know this virus is created by Anak SMU Semarang, if you have sample please send to me !
Destructive	:	Not yet Analize, I don't have sample for analize, all I know this virus is created by Anak SMU Semarang, if you have sample please send to me !
Effect	:	Not yet Analize, I don't have sample for analize, all I know this virus is created by Anak SMU Semarang, if you have sample please send to me !
Hint	:	Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz

_________

Back to content


WM. Andry Chistian

Original Name	:	Andry Chistian
Scanned as	:	Andry.A
Origin	:	Jakarta, West Java
Author	:	Andry Chistian
Variant	:	Not yet founded
Organization/Group	:	HACKERS Labs.
Stealth	:	Yes
Active	:	01 March and every second 01 or 03
Macro in Document	:	AutoOpen
Macro in Normal	:	AutoOpen
May I checking macro ?	:	You can't checking macro cause ToolsMacro and FileTemplates removed by this virus !
Destructive	:	Yes, very very destructive
Effect	:	• If you open word that was infected by this virus in 01 March, your document will be protected with password "Andry Chistian" then you will see text moving in status bar and messagebox after that, If your system second = 01 or 03, he will format your Harddisk. • In everyday, if your system second = 01 or 03, he will format your Harddisk. • If you push "No" button he will change your autoexec.bat and CONFIG.SYS
Hint	:	When you meet messagebox, don't push any buttons, don't panic!!, Just TURN OFF your computer!!, that the best way to save your Computer. TURN ON again and run "scandisk" or "chkdsk"  for checking your Harddisk.  Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
Screen Shot

Text Moving in the status bar :

* I'M ANDRY CHRISTIAN, IF YOU THOUGHT, YOUR DOCUMENTS OR TEMPLATES WERE SAFE, YOU WERE WRONG ! *

________

Back to content


WM. Bukit Asam

Original Name	:	Bukit Asam
Scanned as	:	Bukit.A
Origin	:	Bukit Asam, South Sumatra
Author	:	Unknown
Variant	:	Not yet founded
Organization/Group	:	Unknown
Stealth	:	Yes
Active	:	25 every Month
Macro in Document	:	AutoOpen, FileSaveAs, ToolsMacro
Macro in Normal	:	AutoOpen, FileSaveAs, ToolsMacro
May I checking macro ?	:	Yes, but be sure Only WM.Bukit infect your Word, if you not sure, don't do it!
Destructive	:	Not destructive, just show the MessageBox
Effect	:	• On the 25th of any month it displays the MessageBox:  "Selamat Sekarang adalah tanggal 25, sudahkah anda mengambil gaji? He..he..Selamat. Kalau bisa, lebih keras lagi kerjanya.  Bravo Bukit Asam !!!" in English mean : "Congratulations Now is date 25, are you already accept your financial fee?, He..he.. Congratulations. If you can, keep on good work. Bravo Bukit Asam !!!" • Depending on the system date on FileSaveAs the virus displays the MessageBox: "Non Critical Error Internal error was occurred in module UNIDRV.DLL Your application may not be work normally. Please contact Microsoft Product Support." • On entering Tools/Macro menu (macros ToolsMacro) it displays the MessageBox:  "Critical Error Internal error was occurred in module UNIDRV.DLLPlease contact Microsoft Product Support."
Hint	:	If you sure only WM.Bukit infect your Word, you can delete this virus from FileTemplates, if you not sure, don't do it! Delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV
________

Back to content


WM. Bandung.xx
WM. Bandung

Original Name	:	Bandung
Scanned as	:	Bandung
Origin	:	Bandung, West Java
Author	:	Unknown
Variant	:	Bandung.xx, may be Rapi.xx is variant too
Organization/Group	:	Unknown
Stealth	:	Yes
Active	:	Date > 20 and time > 11
Macro in Document	:	AutoExec, AutoOpen, FileSave, FileSaveAs, ToolsCustomize, ToolsMacro
Macro in Normal	:	AutoExec, AutoOpen, FileSave, FileSaveAs, ToolsCostumize, ToolsMacro
May I checking macro ?	:	No!, don't doit!!, is to dangerous all "a" will replace with "#@"
Destructive	:	Yes
Effect	:	• On date > 20 and time > 11 month it displays Text in status bar, after that all file on C: will be deleted • Drop file on drive C: called PESAN.TXT • If you do use ToolsMacro and ToolsCustomize, all "a" will replace with "#@"
Hint	:	If you found PESAN.TXT in your root directory, please scan all document!. Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot:

When You checking Macro :

Text on status bar:

"Reading Menu...Please wait !"

PESAN.TXT contain:

Anda rupanya sedang sial, semua file di mesin ini kecuali yang berada di direktori WINDOWS dan WINWORD telah hilang, jangan kaget, ini bukan ulah Anda, tapi ini hasil pekerjaan saya...Barang siapa yang berhasil menemukan cara menangkal virus ini, saya akan memberi listing virus ini untuk Anda !!! Dan tentu saja saya akan terus datang kesini untuk memberi Anda salam dengan virus-virus terbaru dari saya...selamat !   Bandung,

In English mean :

Your are in the bad day, all files in the machine expected in directory WINDOWS and WINWORD is gone, don't panic, this is not your foul, but this is happen by my job... If anyone know how to defeat this virus, I will give source code of this virus to you !!! And of course I will back for give you greets with my newest virus from Me... Congratulation! Bandung,

________

Back to content


WM. Brotherhood of NOD

Original Name	:	Brotherhood of NOD
Scanned as	:	Unscan
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy]
Variant	:	Not yet Founded
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date  13 every Month
Macro in Document	:	AutoOpen, NOD, Tiberium
Macro in Normal	:	AutoOpen, AutoClose, FileTemplates, ToolsMacro
May I checking macro ?	:	No!, don't doit!!, is to dangerous your document will be passworded
Destructive	:	Yes, if date 13 this virus won't let you know the password
Effect	:	• On date 13 will protect your document with "TimeValue" and show messagebox  • Drop file on drive C:\WINDOWS called NOD.INI if you checking macro, that file contain password for open your document
Hint	:	If your document passworded after checking macro and see dialogbox like below, try  check in WINDOWS directory, password for your document can be found in NOD.INI file If you found NOD.INI in your WINDOWS directory, please scan all document!. Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot:

When You checking Macro

On date 13 every month

Dropped file contain

/----------------------------------------------------------------------------------------------\

|Virus name: Brotherhood Of NOD                                         |

|Origin    : Indonesia, Yogyakarta                                          |

|Author    : Foxz NoMercy Members                                      |

|URL     : http://www.geocities.com/ResearchTriangle/3996 |

\----------------------------------------------------------------------------------------------/

Dear NoMercy,...

You was disturb this virus! please dont doit again"

Password For C:\ASS\ASS.DOC = 12:12

I'm fair !!, I let you know the password for "

Your document. Peace!! and Unity!!"

--><--><--><--><--><--><--><--><--><--><--><--><--><--><--"

________

Back to content


WM. Chicken Pox

Original Name	:	Chicken Pox 01
Scanned as	:	CVCK.A
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy] with Our CVCK
Variant	:	Not yet Founded
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date  1 and 31 every Month
Macro in Document	:	Action, Action2, ActionDate, DefeatAV, AutoOpen, stdClose, HelpAbout, FileTemplates, ToolsMacro, ToolsCustomize, Organizer
Macro in Normal	:	Action, Action2, ActionDate, AutoExec, AutoClose, stdOpen, HelpAbout, FileTemplates, ToolsMacro, ToolsCustomize, Organizer
May I checking macro ?	:	Yes, not dangerous
Destructive	:	No
Effect	:	• On date 1 and 31 show messagebox  • Blocking ToolsMacro, FileTemplates, Tools Customize, and HelpAbout
Hint	:	Try type "chicken" and press F3  if graphic CHICKEN-POX 01 exist, becarefull Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

When date 1

When date 31

When User Access HelpAbout

When user try checking Macro

  _________

Back to content


WM. Etna

Original Name	:	Etna Mountain
Scanned as	:	Unscan
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy]
Variant	:	Not yet Founded
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	When checking FileModelli, StrumMacro
Macro in Document	:	AutoOpen, AutoClose, NoMercy
Macro in Normal	:	AutoOpen, AutoClose, FileModelli, StrumMacro
May I checking macro ?	:	Yes, not dangerous
Destructive	:	No
Effect	:	Blocking FileModelli, StrumMacro
Hint	:	If you not Use Italian Word, this virus will not attack Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

When use FileModelli, StrumMacro

_________

Back to content


WM. Victor Widjaja

Original Name	:	Victor Widjaja
Scanned as	:	Jaja.A
Origin	:	Jakarta, West Java
Author	:	Victor Widjaja
Variant	:	Not yet Founded
Organization/Group	:	Virus Research Laboratory
Stealth	:	Yes
Active	:	1 November
Macro in Document	:	AutoOpen, FileOpen, FilePrint, FileSavaAs, ToolsMacro, FormatStyle, ViewToolbars, VIctorWidjaja, FileTemplates, ToolsCustomize
Macro in Normal	:	AutoOpen, FileOpen, FilePrint, FileSavaAs, ToolsMacro, FormatStyle, ViewToolbars, VIctorWidjaja, FileTemplates, ToolsCustomize
May I checking macro ?	:	Yes, but will not work ! :)
Destructive	:	Yes
Effect	:	• Disable FilePrint, virus will insert text into document and you will see text moving in status bar • If you open word that was infected by this virus in 01 November, you will see text moving in status bar and messagebox after that, If your system second = 01 or 03, he will format your Harddisk. • In everyday, if your system second = 01 or 13, he will format your Harddisk. • If you push any buttons, It dangerous !!
Hint	:	When you meet messagebox, don't push any buttons, don't panic!!, Just TURN OFF your computer!!, that the best way to save your Computer. TURN ON again and run "scandisk" or "chkdsk"  for checking your Harddisk.  Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

Text moving in status bar:

[ Welcome to Victor Widjaja `WordMacro' Virus - Programmed & Created by Victor Widjaja the HACKER - Virus Research Labolatory ]

Text inserted in document:

Welcome to Victor Widjaja Virus

Your computer has been totally infected by    ''Victor Widjaja'' WordMacro Virus"

Don't go anywhere !!!

I'll be back soon to DESTROY your disk data !!

Copyright © 1996 Virus Research Labs.

_________

Back to content


WM. Foxz

Original Name	:	Foxz
Scanned as	:	CVCK.B
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy]
Variant	:	CVCK.E
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Every Sunday , date 1 and date 13
Macro in Document	:	Action, ActionDate, AutoOpen, AutoExec, FileTemplates, FilePrint, FilePrintDefault, stdClose, EditAutoText, ToolsMacro,
Macro in Normal	:	Action, ActionDate, AutoClose, DefeatAV, FileTemplates, FilePrint, FilePrintDefault, EditAutoText, stdOpen, ToolsMacro,
May I checking macro ?	:	No!, to dangerous
Destructive	:	Yes
Effect	:	• On date 1 or date 13 dialogbox will appear, and you lost all document you opened before, I'm sorry ;( • On every Sunday print command will disable • Blocking ToolsMacro, FileTemplates, Tools Customize, virus will insert text into document!
Hint	:	Try type "Foxz" and press F3 if graphic FOXZ exist, becarefull Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV. Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

_________

Back to content


WM. Visit

Original Name	:	Visit NoMercy WEB
Scanned as	:	CVCK.D
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy]
Variant	:	Not yet Found
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 13 every Month
Macro in Document	:	Action, ActionDate, AutoOpen, AutoExec, Stealth, StlhClose
Macro in Normal	:	Action, ActionDate, AutoClose, DefeatAV, FileTemplates, stlhOpen, ToolsMacro, Stealth
May I checking macro ?	:	Yes!, Not dangerous
Destructive	:	No
Effect	:	• On date 13 dialogbox will appear • Blocking ToolsMacro, FileTemplates, Tools Customize
Hint	:	Try type "NoLogo" and press F3 if graphic NoMercy exist,  you already infected  Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot:

_________

Back to content


WM. Ono We

Original Name	:	Ono We
Scanned as	:	ShowOff.A
Origin	:	Yogyakarta, Central Java
Author	:	Foxz and CrazyMan, [NoMercy] we not claim the maker of this virus, but we can prove that we make this.
Variant	:	ShowOff.xx
Organization/Group	:	NoMercy
Stealth	:	No
Active	:	Date 13 every Month
Macro in Document	:	AutoOpen, Cfxx, Show
Macro in Normal	:	AutoClose, AutoExec, Ofxx
May I checking macro ?	:	Yes!, Not dangerous
Destructive	:	No
Effect	:	• On date 13 dialogbox will appear • If open/close show messagebox
Hint	:	You can delete this virus using ToolsMacro
ScreenShoot:

When date = 11 or 13

When Open document

Already infected	Before infected

_________

Back to content


WM. Birthday

Original Name	:	Happy Birthday
Scanned as	:	ShowOff.C
Origin	:	Yogyakarta, Central Java
Author	:	Foxz and CrazyMan, [NoMercy] we not claim the maker of this virus, but we can prove that we make this.
Variant	:	ShowOff.xx
Organization/Group	:	NoMercy
Stealth	:	No
Active	:	Date 11 and 13 every Month
Macro in Document	:	AutoOpen, Cfxx, Show
Macro in Normal	:	AutoClose, AutoExec, Ofxx
May I checking macro ?	:	Yes!, Not dangerous
Destructive	:	No
Effect	:	On date 11 or 13 dialogbox will appear
Hint	:	You can delete this virus using ToolsMacro
ScreenShoot:

On date 11 or 13 you will see this dialog

_________

Back to content


WM. NoMercy

Original Name	:	NoMercy
Scanned as	:	ShowOff.G
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy]
Variant	:	ShowOff.xx
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 13 every Month
Macro in Document	:	AutoOpen, Nomercy2, Show, ToolsMacro, Organizer, FileTemplates
Macro in Normal	:	AutoClose, AutoExec, Nomercy, ToolsMacro, Organizer, FileTemplates
May I checking macro ?	:	Yes!, but nothing happen
Destructive	:	Yes
Effect	:	• On date 13 All file with extension *.BAT, *.SYS In ROOT directory, *.GRP, *.DRV and *.DLL in WINDOWS directory and *.DRV, *.DLL in WINDOWS\SYSTEM directory will be delete! • Still on date 13 , virus will drop a file called "NOMERCY.DLL" In WINDOWS\SYSTEM\, and that file will become NOMERCY2.COM. • Still on date 13 , virus will overwrite Autoexec.bat for execute NOMERCY2.COM
Hint	:	Please delete or rename you DEBUG. EXE file, cause that file will execute this virus (or other virus) to make a new execution file. Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete NORMAL.DOT before do this!  Happy Hunting! Foxz
ScreenShoot:

When date 13 every Month

When checking macro

_________

Back to content


WM. NoMercy II

Original Name	:	NoMercy II
Scanned as	:	ShowOff.AC
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy]
Variant	:	ShowOff.xx
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 13 every Month
Macro in Document	:	AutoOpen, Nomercy2, Show, ToolsMacro, Organizer, FileTemplates
Macro in Normal	:	AutoClose, AutoExec, Nomercy, ToolsMacro, Organizer, FileTemplates
May I checking macro ?	:	Yes!, All file will be lost
Destructive	:	Yes
Effect	:	• On date 13 All file with extension *.BAT, *.SYS In ROOT directory, *.GRP, *.DRV and *.DLL in WINDOWS directory and *.DRV, *.DLL in WINDOWS\SYSTEM directory will be delete! • Still on date 13 , virus will drop a file called "NOMERCY.DLL" In WINDOWS\SYSTEM\, and that file will become NOMERCY2.COM. • Still on date 13 , virus will overwrite Autoexec.bat for execute NOMERCY2.COM
Hint	:	Try type "wall" and press F3 if graphic WALL exist, becarefull I warn You!! Please delete or rename you DEBUG.EXE file, cause that file will execute this virus (or other virus) to make a new execution file. Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot:

When User try Checking Macro :

On date  13 every Month :

_________

Back to content


WM. Ririn

Original Name	:	Rr.Sixth Setyorini (Ririn)
Scanned as	:	ShowOff.R
Origin	:	Yogyakarta, Central Java
Author	:	Idban now Known as Foxz, [NoMercy]
Variant	:	ShowOff.xx
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 07 November
Macro in Document	:	AutoOpen, Ririn2, MetUltah, ToolsMacro, Organizer, FileTemplates
Macro in Normal	:	AutoClose, AutoExec, Ririn, ToolsMacro, Organizer, FileTemplates
May I checking macro ?	:	No!, to dangerous
Destructive	:	Yes, if you try to check her
Effect	:	• On 07 November virus will drop a file called "RIRIN.DLL" In WINDOWS\SYSTEM\, and that file will become RIRIN.COM • Still on date 13 , virus will rename AUTOEXEC.BAT to AUTOEXEC.RIN for execute RIRIN.COM • If you do checking macro. All file with extension *.BAT, *.SYS In ROOT directory, *.GRP, *.DRV and *.DLL in WINDOWS directory and *.DRV, *.DLL in WINDOWS\SYSTEM directory will be delete!
Hint	:	Please delete or rename you DEBUG.EXE file, cause that file will execute this virus (or other virus) to make a new execution file. Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot:

When Date 07 November :

If You do checking macro :

Title box always change depending what commend you use!

_________

Back to content


WM. VisuaLand

Original Name	:	VisuaLand
Scanned as	:	GoldSecret.A
Origin	:	Jakarta, West Java
Author	:	Milky Wahyudi Widjaja
Variant	:	Not Yet founded
Organization/Group	:	VisuaLand
Stealth	:	No  (Why his claim the best virus ?)
Active	:	When you select About VisuaLand Technology GoldSecret
Macro in Document	:	AutoOpen, FileSaveAs, VisuaLand
Macro in Normal	:	AutoOpen, FileSaveAs, VisuaLand
May I checking macro ?	:	Yes
Destructive	:	No!
Effect	:	• Add About VisuaLand Technology GoldSecret below HelpAbout when you select About VisuaLand Technology GoldSecret you will meet DialogBox • When Infect your NORMAL.DOT a MessageBox appear
Hint	:	You can defeat this virus with ToolsMacro or FileTemplates Happy Hunting! Foxz
ScreenShoot :

When you select About VisuaLand Technology....

When infect your NORMAL.DOT :

_________

Back to content


WM. Dzutaqshiri

Original Name	:	Dzutaqshiri
Scanned as	:	Dzt.A
Origin	:	Bandung, West Java
Author	:	Hikmat Sudrajat
Variant	:	Not Yet founded
Organization/Group	:	NONE
Stealth	:	No
Active	:	When you print your document
Macro in Document	:	AutoOpen, FileSaveAs
Macro in Normal	:	FileSave, FileSaveAs,
May I checking macro ?	:	Yes!
Destructive	:	Yes! You can't print until this virus remove
Effect	:	• Disable print when you try to print your document • Add comment DZT in FileSummaryInfo
Hint	:	You can defeat this virus with ToolsMacro or FileTemplates Happy Hunting! Foxz
ScreenShoot :

Text in statusbar, when you print your document :

This command is not available because a document window is not active

_________

Back to content


WM. Krakatau

Original Name	:	Krakatau
Scanned as	:	KillOk.C
Origin	:	Yogyakarta, Central Java
Author	:	Original by CrazyMan, fixed by Foxz [NoMercy]
Variant	:	Not Yet founded
Organization/Group	:	NoMercy
Stealth	:	Yes !
Active	:	When you Try Checking Macro
Macro in Document	:	AutoOpen, NoMercy, FileTemplates, ToolsMacro
Macro in Normal	:	AutoOpen, FileTemplates, ToolsMacro
May I checking macro ?	:	No!, to dangerous
Destructive	:	Yes! If you do checking macro
Effect	:	• Protect document with random password "TimeValue"
Hint	:	Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
_________

Back to content


WM. Rapi.xx

Original Name	:	@Rapi.Kom
Scanned as	:	Rapi
Origin	:	Malang, East Java
Author	:	Unknown
Variant	:	may be Bandung.xx, in the body the code look like Bandung
Organization/Group	:	Unknown
Stealth	:	Yes
Active	:	Everytime
Macro in Document	:	AutoOpen, RpAE, RpFS, RpFSA, RpTC, RpTM, RpFO
Macro in Normal	:	RpAO, AutoExec, FileSave, FileSaveAs, FileOpen, ToolsCostumize, ToolsMacro,
May I checking macro ?	:	No!, don't doit!!, is to dangerous all "a" will replace with "#@"
Destructive	:	Yes
Effect	:	• Drop file on drive C: called BACALAH.TXT • If you do use ToolsMacro and ToolsCustomize, all "a" will replace with "#@" • If you open document (NORMAL.DOT was infected) you will see MessageBox
Hint	:	If you found BACALAH.TXT in your root directory, please scan all document!. Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

When You checking Macro :

When you Open document (NORMAL.DOT was infected) :

BACALAH.TXT contain :

"Assalamualaikum ..., maaf @Rapi.Kom mengganggu anda sebentar. Pesan ini aslinya bernama  PESAN.TXT  yang  muncul  di  root direktori  setelah  anda menjalankan Winword 6.0 yang templatenya (normal.dot)  telah  tertulari  macro  menjijikkan ini. Macro ini (sebelum @Rapi.Kom modifikasi)  berasal  dari  file data Winword 6.0 (*.doc) yang telah tertular macro ini. Bila file data tersebut  di pangggil (Open doc), maka macro secara otomatis menjalankan perintah-perintah macro lain nya,  yang antara  lain mengcopykan  diri ke global template (normal.dot), juga pada tanggal dan jam tertentu akan menghapus semua data di direktori tingkat 1, 2 dan 3 (kecuali Hidden direktori), menjengkelkan bukan ?!. Siapapun pembuatnya pastilah orang yang sirik !,  masih banyak perbuatan baik lain yang  bisa  kita kerjakan.         ... Malang,  @Rapi.Kom"

In English mean :

" Assalamualaikum ..., Sorry wait a second @Rapi.Kom distrub you. The original message named PESAN.TXT that dropped in root directory after you execute Winword 6.0 if normal.dot was infected by this asshole macro. This macro (before @Rapi.Kom modified) come from data file Winword 6.0 (*.doc) that was infected this macro. If that file execute (Open doc), macro automatically execute other viral code, i.e. make copy to global template (normal.dot), and in special date or special time I will delete all data in derectory level 1, 2 and 3 (expected Hidden directory), very good huh?!. The maker is maniac !, there much good thing that we can do.   ...Malang, @Rapi.Kom

_________

Back to content


WM. Junkies

Original Name	:	Junkies
Scanned as	:	JunkFace.A
Origin	:	Yogyakarta, Central Java
Author	:	CrazyMan [NoMercy]
Variant	:	Always Change (this virus always change every infect)
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 11 every Month
Macro in Document	:	AutoClose, NoMercy
Macro in Normal	:	AutoClose, FileTemplates, ToolsMacro,
May I checking macro ?	:	Yes, but nothing happen
Destructive	:	No
Effect	:	• In date 11 you will see MessageBox • If you do use ToolsMacro and FileTemplates Nothing happen
Hint	:	Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

Appear in date 11 every Month

_________

Back to content


WM. Junkies Update

Original Name	:	Junkies Update
Scanned as	:	JunkFace.B
Origin	:	Yogyakarta, Central Java
Author	:	CrazyMan [NoMercy]
Variant	:	Always Change (this virus always change every infect)
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 11 every Month
Macro in Document	:	AutoClose, NoMercy
Macro in Normal	:	AutoClose, FileTemplates, ToolsMacro,
May I checking macro ?	:	Yes, but nothing happen
Destructive	:	No
Effect	:	• In date 11 you will see MessageBox • If you do use ToolsMacro and FileTemplates Nothing happen
Hint	:	Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

Appear in date 11 every Month

_________

Back to content


WM. Junkies 02

Original Name	:	Junkies 02
Scanned as	:	JunkFace.C
Origin	:	Yogyakarta, Central Java
Author	:	CrazyMan [NoMercy]
Variant	:	Always Change (this virus always change every infect)
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 11 every Month
Macro in Document	:	AutoClose, NoMercy
Macro in Normal	:	AutoClose, FileTemplates, ToolsMacro,
May I checking macro ?	:	Yes, but nothing happen
Destructive	:	No
Effect	:	• In date 11 you will see MessageBox • If you do use ToolsMacro and FileTemplates Nothing happen
Hint	:	Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

Appear in date 11 every Month

_________

Back to content


WM. TenFaces

Original Name	:	TenFaces
Scanned as	:	Mercy.A
Origin	:	Yogyakarta, Central Java
Author	:	CrazyMan [NoMercy]
Variant	:	Not Yet Founded
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	When checking Macro
Macro in Document	:	AutoOpen, xxxxxLove, xxxxxAnik, xxxxx1109 (xxxxx = random string)
Macro in Normal	:	FileClose, FileTemplates, ToolsMacro, Organizer, ToolsCustomize xxxxxLove, xxxxxAnik, xxxxx1109 (xxxxx = random string)
May I checking macro ?	:	No!, You can type anymore
Destructive	:	Yes
Effect	:	• Insert Text in WIN.INI  • If you do use ToolsMacro and FileTemplates Keyboat layout change
Hint	:	If you found text in WIN.INI like below, scan all your document !! Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

When you try checking macro :

Text in WIN.INI:

[Intl]

Code_Name=WORDMACRO.TENFACES

Creator=Creator of NoMercy!

Dedicated=My Love, Anik AY

_________

Back to content


WM. TenFaces II

Original Name	:	TenFaces II
Scanned as	:	Mercy.B
Origin	:	Yogyakarta, Central Java
Author	:	CrazyMan [NoMercy]
Variant	:	Not Yet Founded
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 11 every Month
Macro in Document	:	AutoExec, AutoOpen, xxxxx, xxxxx, xxxxx  (xxxxx = random string)
Macro in Normal	:	AutoClose, FileTemplates, ToolsMacro, Organizer, , xxxxx, xxxxx (xxxxx = random string)
May I checking macro ?	:	No!,
Destructive	:	Yes
Effect	:	• Insert Text in WIN.INI
Hint	:	If you found text in WIN.INI like below, scan all your document !! Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

When you try checking macro :

Text in WIN.INI :

[ Intl ]

I_am_here

Here_1

Here_2

Here_3

Here_4

Here_5

_________

Back to content


WM. Toegoe

Original Name	:	Toegoe
Scanned as	:	KillOk.B
Origin	:	Yogyakarta, Central Java
Author	:	CrazyMan [NoMercy]
Variant	:	Not Yet founded
Organization/Group	:	NoMercy
Stealth	:	Yes !
Active	:	When you Try Checking Macro
Macro in Document	:	AutoClose, NoMercy
Macro in Normal	:	AutoClose, FileTemplates, ToolsMacro
May I checking macro ?	:	No!, to dangerous
Destructive	:	Yes! If you do checking macro
Effect	:	• No Effect Just prove that AntiHeuristics Work
Hint	:	Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
_________

Back to content


WM. Vampire

Original Name	:	Vampire
Scanned as	:	CVCK.C
Origin	:	Yogyakarta, Central Java
Author	:	80e, with Our CVCK
Variant	:	Not yet Founded
Organization/Group	:	K-80e
Stealth	:	Yes
Active	:	Every Friday
Macro in Document	:	Action, ActionDate, AutoExec, AutoOpen, sthlClose, Stealth
Macro in Normal	:	AutoClose, ActionDate, DefeatAV, sthlOpen, FileTemplates, ToolsMacro, ToolsCustomize, Organizer, Stealth
May I checking macro ?	:	No, very dangerous
Destructive	:	Yes
Effect	:	• On Friday all data opened will be lost  • Blocking ToolsMacro, FileTemplates, Tools Customize, and if execute, you will access viral code. If user use 9x he will delete : C:\WINDOWS\START MENU\*.* C:\WINDOWS\TASKMAN.*  C:\WINDOWS\EXPLORER.*  C:\WINDOWS\WIN95.* If user use 3.xx he will delete : C:\WINDOWS\WIN.*
Hint	:	Try type "vampire" and press F3 if graphic VAMPIRE exist, becarefull Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

For WIN9x user :

For WIN 3.xx :

_________

Back to content


WM. Strezz

Original Name	:	STREZZ
Scanned as	:	Strezz.A
Origin	:	Jakarta, West Java
Author	:	Dark Love & Lady Love
Variant	:	Not yet Founded
Organization/Group	:	[IVR] - Internation Virus Research
Stealth	:	Yes
Active	:	When print document
Macro in Document	:	AutoOpen, FilePrint, FileSaveAs
Macro in Normal	:	AutoOpen, FilePrint, FileSaveAs
May I checking macro ?	:	You can't do this, this command was remove by virus
Destructive	:	Yes
Effect	:	• When use FilePrint virus will inset text into document  • Blocking ToolsMacro, FileTemplates, Tools Customize, and if execute, you will access viral code.
Hint	:	Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

When you use FilePrint :

Text insert into  document:

STRESS '97

Special for my love by

The Free Hackers

Viroright (C) 1997 Internation Virus Research

If you have bugs, please call me and don't stress for it! I will back laler!

_________

Back to content


WM. Surabaya

Original Name	:	Surabaya
Scanned as	:	Surabaya.A
Origin	:	Surabaya, East Java
Author	:	ICE - Man
Variant	:	Not yet Founded
Organization/Group	:	Lontong Micro Device
Stealth	:	Yes
Active	:	When start Word
Macro in Document	:	AutoOpen, FileSaveAs, Autoexec, ToolsMacro, FileTemplates, Plong
Macro in Normal	:	AutoOpen, FileSaveAs, Autoexec, ToolsMacro, FileTemplates, Plong
May I checking macro ?	:	You can't do this, this command was blocked by virus
Destructive	:	No
Effect	:	• When Start Word text print in status bar  • Blocking ToolsMacro, FileTemplates, Tools Customize, you will meet messagebox  • Plong macro contain text:  This Macro was created by : The ICE - "Yes"  Man             Allah Swt always be with All of You ....                               Surabaya, 09-09-1996 • Insert text in WIN.INI
Hint	:	Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScrenShoot :

When try to cheking Macro :

Text print in status bar :

"Lontong Micro Device (c) 1993 By ICE-Man"

Text in WIN.INI

[Author]

Name=TeBeYe`93 The ICE-Man"

_________

Back to content


WM. Npad.xx

Original Name	:	D0EUNPAD94
Scanned as	:	Npad
Origin	:	Bandung, West Java
Author	:	Unknown
Variant	:	Npad.xx
Organization/Group	:	UNPAD (Padjajaran University)
Stealth	:	No
Active	:	When virus has 23 time replicate
Macro in Document	:	AutoOpen
Macro in Normal	:	AutoOpen
May I checking macro ?	:	Yes
Destructive	:	No
Effect	:	• When virus has 23 time replicate, you will see text moving in status bar
Hint	:	If you sure only WM.Npad infect your Word, you can delete this virus from ToolsMacro, if you not sure, don't do it! Happy Hunting! Foxz
ScrenShoot :

Text moving in status bar:

D0EUNPAD94,  v.2.21,  (c)  Maret  1996,  Bandung,  Indonesia

_________

Back to content


WM. Phardera.xx

Original Name	:	Phardera
Scanned as	:	Phardera
Origin	:	Jakarta, West Java
Author	:	Anton R.P. (I know you !!)
Variant	:	Phardera.xx
Organization/Group	:	VBB
Stealth	:	No
Active	:	Date 14 and 31 every Month
Macro in Document	:	FileOpen
Macro in Normal	:	FileOpen
May I checking macro ?	:	No, this command removed by this virus
Destructive	:	No
Effect	:	• In date 14 or 31 this virus show MessageBox
Hint	:	Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot:

When date 14 you will see this message :

 When date 31 you will see this message :

_________

Back to content


Dedicate

This NVLR is dedicate to :

- My brother CrazyMan - Hello brother.....

- My friend Clara R.I Fernandez in Yogyakarta, Central Java - See ya in IRC

- My friend Rr.Sixth Setyorini in Surabaya, East Java  - I miss you !!

- CrazyMan GirlFriend, Anik AY - Thanks for your support

- Gurita NoMercy Members - Hi, we still waiting your virus

- All NoMercy fans - Hi, folk take alook this one

_________

Back to content


Thanks

Special Thanks to :

Cicatrix  - Thanks for help me to get virus samples and distribute all NoMercy product

Aurodreph  - Thanks for your fast respons buddy

Mike Janda  - Thanks for your great LWM 1.10, your program very very great!

Phardera  - Thanks for your Information, koq udah lama nggak ngirim artikel ke MD?

D.Giovanni - I'm still waiting Juventus Flag :)

You - Thanks for downloading NVLR

NoThanks to:

SLAM VIRUS TEAM - We getting boring waiting Replay !!, accept or not we want replay

Milky Wahyudi Widjaja - I hate with your VisuaLand, your virus make Indonesian Virus Writer Bad

_________

Back to content