Copyright: NVLR is Copyright by NoMercy 1997-1998


BEST VIEW WITH 800X600 24BIT COLORS!!

NVLR is copyright NoMercy 1997-1998

NoMercy WEB PAGE

http://www.geocities.com/ResearchTriangle/3996

Peoples behind NVLR 0.2

Graphic D-sign, Captured effect and  Author by:

Foxz [NoMercy]

Virus Hunter by:

Gurita [NoMercy]

Beta Tester by:

CrazyMan [NoMercy]

Lucifer [NoMercy]

Gurita [NoMercy]

D.Giovanni [NoMercy Honored Member]

Coffee, Foods and  Color consultants by:

Anik AY [CrazyMan girlfriend]


Introduction
What is NVLR?

Comment about NVLR 0.1


What's New
Minor change

Major change


Dedicate & Thank's
Dedicated to

Thanks to


Labs. Report
List below is order by original name, not scanned name like AVers report

WM. Anak SMU	WM. Krakatau	WM. Phardera.xx	WM. Visit
WM. Andry Christian	WM. Lucifer	WM. Ririn	WM. VisuaLand
WM. Bandung.xx	WM. Junkies	WM. Rapi.xx	WM. VisuaLand.2
WM. Birthday	WM. Junkies Update	WM. TenFaces	---
WM. Brotherhood of NOD	WM. Junkies 02	WM. TenFaces II	---
WM. Bukit Asam	WM. Npad.xx	WM. Toegoe	---
WM. Chicken Pox	WM. NoMercy	WM. Strezz	---
WM. Dzutaqshiri	WM. NoMercy II	WM. Surabaya	---
WM. Etna	WM. Ono We	WM. Vampire	---
WM. Foxz	WM. Pesan	WM. Victor Widjaja	---


Distribution
Where can I get Update this file?


Registration


About
The Author

NoMercy

Disclaimer


Disclaimer

You are granted the right to use and to make an unlimited number of copies of this software. You may not disassemble, decompose, reverse  engineer, or alter this file or any of the other files in the package.

This file is provided as FREEWARE and cannot be sold. This restriction  does not apply to connect time charges, or flat rate connection/download  fees for electronic bulletin board services. This software can not be  bundled with any commercial package without express written permission  from the author.

The author of this program accepts no responsibility for damages resulting from the use of this product and makes no warranty or representation, either express or implied, including but not limited to, any implied  warranty of merchant ability or fitness for a particular purpose. This software is provided "AS IS", and you, its user, assume all risks when  using it. :)

You may NOT rewrite this file and publish to computer magazine without given credits to NoMercy. (FIFA say : "Fair play")

_____________

Back


What's Next
What's in Next Version?


NoMercy
NoMercy VirusTeam

A small virus group that founded April 6th 1997 by Foxz and CrazyMan. In the first time Our group named CrazybitS, that's why Our Construction named CVCK (CrazybitS Virus Construction Kits).

Some people say way must change the name ?, cause Our first destructive virus called NoMercy (scanned as ShowOff.G), and was going wild in Our Neighborhood and every date 13 our victims say "My computer was attack by NoMercy!" so.. We change to NoMercy.

Not Like other group, we specific in Macro Only and All member is Indonesian only!. If you want join with us drop your question to foxz@usa.net

And now current member are :

Name	:	Foxz
Origin	:	South Sumatra
Email	:	foxz@usa.net
Code	:	N001-060497M
Div.	:	VirusMaker, Editorial, Graphics D-Sign, Web Master, Organizer, TeamCreative
Sex	:	Male
Msg.	:	More Peoples Know Your Ability, More Enemy You Got
Name	:	CrazyMan
Origin	:	South Sumatra
Email	:	crazyman.nomercy@usa.net
Code	:	N002-060497M
Div.	:	Coder, VirusMaker, VirusTester, OffLineDivision
Sex	:	Male
Msg.	:	Its Easy To Claim But Difficult To Make
Name	:	Gurita
Origin	:	North Sumatra
Email	:	gurita.nomercy@usa.net
Code	:	N003-030597M
Div.	:	VirusHunter, SpreadDivision, VirusTester
Sex	:	Male
Msg.	:	Belom tau dia
Name	:	Lucifer
Origin	:	Yogyakarta
Email	:	lucifer.nomercy@usa.net
Code	:	N004-010797F
Div.	:	VirusHunter, VirusTester, TeamCreative
Sex	:	Female
Msg.	:	Female more dangerous than male
Name	:	D. Giovanni
Origin	:	Italia [as honored member]
Email	:	slagehammer@usa.net
Code	:	N005-010797M
Div.	:	BetaTester, VirusHunter, Europe Div. InfoHunter
Sex	:	Male
Msg.	:	Ciao Ragazzi Siete Forti

_____________

Back


The Author

Hey, welcome to NVLR 0.2,

Like in NVLR 0.1, I promise to continue NVLR, here it is!. Cause much new virus found this NVLR out faster than I promise to you (I promise out in August), may be next version out in August (being monthly)

I am Sorry if my English is not good, cause I am an Indonesian boy.

If you think this file is great please let me know by fill NoMercy  Guestbook or fill COMMENT.CMT and send it to me, if you want, your comment may include in the next version.

If you feel this can be distribute, distribute its!, but remember, not for sale! Just distribute its for free.

REMEMBER !

Check any document before you open that document, do not believe with your document, who know your document was infected!.

If you wanna rewrite please give NoMercy credit!

Foxz

foxz@usa.net

_____________

Back


Where can I get Update this file?

Aurodreph Cattle

URL = http://www.ilf.net/AURODREPH/virus.htm

email = aurodreph@defiant.ilf.net

Cicatrix Site

URL = http://www.cyberstation.net/~cicatrix

email = cicatrix@usa.net

NoMercy WEB PAGE

URL = http://www.geocities.com/ResearchTriangle/3996

email = nomercy12@hotmail.com

_____________

Back


Dedicate to :

This NVLR is dedicate to :

•	My brother CrazyMan - You're welcome

•	My friend Clara Fernandez in Yogyakarta  - Here again

•	My friend Rr.Sixth Setyorini in Surabaya, East Java  - He..he... !!

•	CrazyMan GirlFriend, Anik AY - Mom, want to see you

•	All NoMercy fans - Hi, folk I waiting your comment

_____________

Back


Thanks to

Special Thanks to:

•	Cicatrix  - What do you think about NVLR 0.2 ?

•	Aurodreph  - I never see your virus :)

•	Anik AY - You will be my sister someday

•	Mike Janda  - Thanks for your great LWM 1.10, your program very very great!

•	D.Giovanni - Thanks for Juventus Flag

•	Lucifer - Good work!!, Cool idea!!, congratulation you are in

•	Phardera  - Thanks for VisuaLand2

•	You - Thanks for downloading NVLR, I am waiting your comment

_____________

Back


File dropper screenshoot
What's in Next Version ?

In the Next version of NVLR, I will try to :

1.	Make more detail description each virus

2.	More User friendly

3.	ScreenShoot of Execution dropped files from virus

4.	URL of best Anti Macro Viruses Site

5.	You must pay for get next NVLR   (just kidding)

If you have any cool idea please send it to me.

_____________

Back


Resgistration
Registration

No Registrtion needed All I need is your comment only, so... please write your comment by fill NoMercy Guestbook or fill COMMENT.CMT and send it to  nomercy12@hotmail.com

If you want, your comment will be include in the next version. Hurry up man, send your comment to me.

But Remember

If you rewrite this file and want to publish you must give credits to NoMercy. (FIFA say : "Fair play")

_____________

Back


Minor change

Like we know new virus born everyday, in this version added 4 new viruses description

WM. Anak SMU

WM. Lucifer

WM. Pesan

WM. VisuaLand 2

_____________

Back


Major change

Cicatrix Site move to "Cyberstations" Again

I try to make different help content, and very user friendly. Are you likes it?

Add comment from NVLR 0.1, thanks for all respon folk!

_____________

Back


WM. Pesan

Original Name	:	Unknown
Scanned as	:	Pesan.A
Origin	:	Jakarta ?, West Java
Author	:	Unknown
Variant	:	Not Yet Found
Organization/Group	:	None
Stealth	:	Yes
Active	:	After 5 minutes starting WORD
Macro in Document	:	AutoOpen, CopyOfFileExit, CopyOfFilesave, NormalAuto, Pesan
Macro in Normal	:	CopyOfAutoOpen, FileExit, FileSave, AutoExec, Pesan
May I checking macro ?	:	Yup!
Destructive	:	No!. In the body of virus no destructive code
Effect	:	• After 5 minutes starting WORD, show 3 diferent messagebox
Hint	:	Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
Note	:	Thanks to McAfee for this Info
ScreenShoot :

Note : No destructive code inside virus body, that's only a joke!

_____________

Back


WM. Anak.SMU
WM. Anak SMU

Original Name	:	Anak SMU
Scanned as	:	Anak.A
Origin	:	Semarang, Central Java
Author	:	Anak SMU
Variant	:	Not Yet Found
Organization/Group	:	None
Stealth	:	Yes
Active	:	Date 25 every month
Macro in Document	:	AnakAE, AutoOpen, AnakAO, AnakSA, AnakSMU
Macro in Normal	:	AutoExec, AnakAO, FileSave, AnakSA, AnakSMU
May I checking macro ?	:	No, command remove by virus
Destructive	:	No
Effect	:	• Starting from 25th of any month, starting from 14:00 the virus creates new template, inserts the text into there: ...i n t r o d u c i n g...          anakSMU Semarang, March 1997 • The virus then registers itself in the system. To do that it creates the ANAKSMU.BAT
Hint	:	Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
Note	:	Thanks to APV for this Info
ScreenShoot:

File ANAKSMU.BAT

@ECHO OFF

 REM -----------------------------------------------------------------------------------

 REM anakSMU wont destroy your REGEDIT, Just wanna be there :)

 REM          email: anakSMU@TheOffice.net"

 REM -----------------------------------------------------------------------------------

 ECHO REGEDIT4 > anakSMU.REG

 ECHO [HKEY_CURRENT_USER\Software\anakSMU] >> anakSMU.REG

 ECHO [HKEY_CURRENT_USER\Software\anakSMU\anakSMU@TheOffice.net] >> anakSMU.REG

_____________

Back


WM. Lucifer

Original Name	:	Lucifer
Scanned as	:	Unscan
Origin	:	Yogyakarta, Central Java
Author	:	Lucifer [NoMercy]
Variant	:	Not yet founded
Organization/Group	:	[NoMercy]
Stealth	:	Yes
Active	:	Date 15 every month
Macro in Document	:	AutoOpen, Lucifer, Close
Macro in Normal	:	AutoOpen, Close, AutoClose, ToolsMacro, FileTemplates
May I checking macro ?	:	You cant checking macro cause ToolsMacro and FileTemplates blocked by this virus !
Destructive	:	No
Effect	:	• If you open word that was infected by this virus in 15 every month, this virus will be insert code in AUTOEXEC.BAT • Change all *.DLL to *.LUS • Lucifer look like hate VisuaLand
Hint	:	Try type lucifer and press F3  if graphic LUCIFER exist, becarefull Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
Screen Shot:

When date 15

When try to checking Macro

Code insert in AUTOEXEC.BAT :

@Echo Off

CD\WINDOWS\

Ren *.dll *.lus

CD\WINDOWS\SYSTEM\

Ren *.dll *.lus

CD\

Ren C:\AUTOEXEC.LUS C:\AOTUEXEC.BAT

_____________

Back


WM. Andry Chistian

Original Name	:	Andry Chistian
Scanned as	:	Andry.A
Origin	:	Jakarta, West Java
Author	:	Andry Chistian
Variant	:	Not yet founded
Organization/Group	:	HACKERS Labs.
Stealth	:	Yes
Active	:	01 March and every second 01 or 03
Macro in Document	:	AutoOpen
Macro in Normal	:	AutoOpen
May I checking macro ?	:	You can't checking macro cause ToolsMacro and FileTemplates removed by this virus !
Destructive	:	Yes, very very destructive
Effect	:	• If you open word that was infected by this virus in 01 March, your document will be protected with password "Andry Chistian" then you will see text moving in status bar and messagebox after that, If your system second = 01 or 03, he will format your Harddisk. • In everyday, if your system second = 01 or 03, he will format your Harddisk. • If you push "No" button he will change your autoexec.bat and CONFIG.SYS
Hint	:	When you meet messagebox, don't push any buttons, don't panic!!, Just TURN OFF your computer!!, that the best way to save your Computer. TURN ON again and run "scandisk" or "chkdsk"  for checking your Harddisk.  Exit Word, delete NORMAL.DOT and don't open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, don't open any document !!, then goto "FileTemplates" push button "Organizer", chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
Screen Shot

Text Moving in the status bar :

* I'M ANDRY CHRISTIAN, IF YOU THOUGHT, YOUR DOCUMENTS OR TEMPLATES WERE SAFE, YOU WERE WRONG ! *

_____________

Back


WM. Bukit Asam

Original Name	:	Bukit Asam
Scanned as	:	Bukit.A
Origin	:	Bukit Asam, South Sumatra
Author	:	Unknown
Variant	:	Not yet founded
Organization/Group	:	Unknown
Stealth	:	Yes
Active	:	25 every Month
Macro in Document	:	AutoOpen, FileSaveAs, ToolsMacro
Macro in Normal	:	AutoOpen, FileSaveAs, ToolsMacro
May I checking macro ?	:	Yes, but be sure Only WM.Bukit infect your Word, if you not sure, dont do it!
Destructive	:	Not destructive, just show the MessageBox
Effect	:	• On the 25th of any month it displays the MessageBox:  Selamat Sekarang adalah tanggal 25, sudahkah anda mengambil gaji? He..he..Selamat. Kalau bisa, lebih keras lagi kerjanya.  Bravo Bukit Asam !!! in English mean : Congratulations Now is date 25, are you already accept your financial fee?, He..he.. Congratulations. If you can, keep on good work. Bravo Bukit Asam !!! • Depending on the system date on FileSaveAs the virus displays the MessageBox: Non Critical Error Internal error was occurred in module UNIDRV.DLL Your application may not be work normally. Please contact Microsoft Product Support. • On entering Tools/Macro menu (macros ToolsMacro) it displays the MessageBox:  Critical Error Internal error was occurred in module UNIDRV.DLLPlease contact Microsoft Product Support.
Hint	:	If you sure only WM.Bukit infect your Word, you can delete this virus from FileTemplates, if you not sure, dont do it! Delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV
_____________

Back


WM. Bandung.xx

Original Name	:	Bandung
Scanned as	:	Bandung
Origin	:	Bandung, West Java
Author	:	Unknown
Variant	:	Bandung.xx, may be Rapi.xx is variant too
Organization/Group	:	Unknown
Stealth	:	Yes
Active	:	Date > 20 and time > 11
Macro in Document	:	AutoExec, AutoOpen, FileSave, FileSaveAs, ToolsCustomize, ToolsMacro
Macro in Normal	:	AutoExec, AutoOpen, FileSave, FileSaveAs, ToolsCostumize, ToolsMacro
May I checking macro ?	:	No!, dont doit!!, is to dangerous all a will replace with #@
Destructive	:	Yes
Effect	:	• On date > 20 and time > 11 month it displays Text in status bar, after that all file on C: will be deleted • Drop file on drive C: called PESAN.TXT • If you do use ToolsMacro and ToolsCustomize, all a will replace with #@
Hint	:	If you found PESAN.TXT in your root directory, please scan all document!. Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot:

When You checking Macro :

Text on status bar:

"Reading Menu...Please wait !"

PESAN.TXT contain:

Anda rupanya sedang sial, semua file di mesin ini kecuali yang berada di direktori WINDOWS dan WINWORD telah hilang, jangan kaget, ini bukan ulah Anda, tapi ini hasil pekerjaan saya...Barang siapa yang berhasil menemukan cara menangkal virus ini, saya akan memberi listing virus ini untuk Anda !!! Dan tentu saja saya akan terus datang kesini untuk memberi Anda salam dengan virus-virus terbaru dari saya...selamat !   Bandung,

In English mean :

Your are in the bad day, all files in the machine expected in directory WINDOWS and WINWORD is gone, don't panic, this is not your foul, but this is happen by my job... If anyone know how to defeat this virus, I will give source code of this virus to you !!! And of course I will back for give you greets with my newest virus from Me... Congratulation! Bandung,

_____________

Back


WM. Brotherhood of NOD

Original Name	:	Brotherhood of NOD
Scanned as	:	Unscan
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy]
Variant	:	Not yet Founded
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date  13 every Month
Macro in Document	:	AutoOpen, NOD, Tiberium
Macro in Normal	:	AutoOpen, AutoClose, FileTemplates, ToolsMacro
May I checking macro ?	:	No!, dont doit!!, is to dangerous your document will be passworded
Destructive	:	Yes, if date 13 this virus wont let you know the password
Effect	:	• On date 13 will protect your document with TimeValue and show messagebox  • Drop file on drive C:\WINDOWS called NOD.INI if you checking macro, that file contain password for open your document
Hint	:	If your document passworded after checking macro and see dialogbox like below, try  check in WINDOWS directory, password for your document can be found in NOD.INI file If you found NOD.INI in your WINDOWS directory, please scan all document!. Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot:

When You checking Macro

On date 13 every month

Dropped file contain

/----------------------------------------------------------------------------------------------\

|Virus name: Brotherhood Of NOD                                         |

|Origin    : Indonesia, Yogyakarta                                          |

|Author    : Foxz NoMercy Members                                      |

|URL     : http://www.geocities.com/ResearchTriangle/3996 |

\----------------------------------------------------------------------------------------------/

Dear NoMercy,...

You was disturb this virus! please dont doit again"

Password For C:\ASS\ASS.DOC = 12:12

I'm fair !!, I let you know the password for "

Your document. Peace!! and Unity!!"

--><--><--><--><--><--><--><--><--><--><--><--><--><--><--"

_____________

Back


WM. Chicken Pox

Original Name	:	Chicken Pox 01
Scanned as	:	CVCK.A
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy] with Our CVCK
Variant	:	Not yet Founded
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date  1 and 31 every Month
Macro in Document	:	Action, Action2, ActionDate, DefeatAV, AutoOpen, stdClose, HelpAbout, FileTemplates, ToolsMacro, ToolsCustomize, Organizer
Macro in Normal	:	Action, Action2, ActionDate, AutoExec, AutoClose, stdOpen, HelpAbout, FileTemplates, ToolsMacro, ToolsCustomize, Organizer
May I checking macro ?	:	Yes, not dangerous
Destructive	:	No
Effect	:	• On date 1 and 31 show messagebox  • Blocking ToolsMacro, FileTemplates, Tools Customize, and HelpAbout
Hint	:	Try type chicken and press F3  if graphic CHICKEN-POX 01 exist, becarefullExit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

When date 1 or date 31

When User Access HelpAbout

When user try checking Macro

_____________

Back


WM. Etna

Original Name	:	Etna Mountain
Scanned as	:	Unscan
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy]
Variant	:	Not yet Founded
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	When checking FileModelli, StrumMacro
Macro in Document	:	AutoOpen, AutoClose, NoMercy
Macro in Normal	:	AutoOpen, AutoClose, , StrumMacro
May I checking macro ?	:	Yes, not dangerous
Destructive	:	No
Effect	:	Blocking FileModelli, StrumMacro
Hint	:	If you not Use Italian Word, this virus will not attack Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileModelli push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

When use FileModelli, StrumMacro

_____________

Back


WM. Victor Widjaja

Original Name	:	Victor Widjaja
Scanned as	:	Jaja.A
Origin	:	Jakarta, West Java
Author	:	Victor Widjaja
Variant	:	Not yet Founded
Organization/Group	:	Virus Research Laboratory
Stealth	:	Yes
Active	:	1 November
Macro in Document	:	AutoOpen, FileOpen, FilePrint, FileSavaAs, ToolsMacro, FormatStyle, ViewToolbars, VIctorWidjaja, FileTemplates, ToolsCustomize
Macro in Normal	:	AutoOpen, FileOpen, FilePrint, FileSavaAs, ToolsMacro, FormatStyle, ViewToolbars, VIctorWidjaja, FileTemplates, ToolsCustomize
May I checking macro ?	:	Yes, but will not work ! :)
Destructive	:	Yes
Effect	:	• Disable FilePrint, virus will insert text into document and you will see text moving in status bar • If you open word that was infected by this virus in 01 November, you will see text moving in status bar and messagebox after that, If your system second = 01 or 03, he will format your Harddisk. • In everyday, if your system second = 01 or 13, he will format your Harddisk. • If you push any buttons, It dangerous !!
Hint	:	When you meet messagebox, dont push any buttons, dont panic!!, Just TURN OFF your computer!!, that the best way to save your Computer. TURN ON again and run scandisk or chkdsk  for checking your Harddisk.  Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

Text moving in status bar:

[ Welcome to Victor Widjaja `WordMacro' Virus - Programmed & Created by Victor Widjaja the HACKER - Virus Research Labolatory ]

Text inserted in document:

Welcome to Victor Widjaja Virus

Your computer has been totally infected by  ''Victor Widjaja''  WordMacro Virus

Don't go anywhere !!!

I'll be back soon to DESTROY your disk data !!

Copyright © 1996 Virus Research Labs.

_____________

Back


WM. Foxz

Original Name	:	Foxz
Scanned as	:	CVCK.B
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy]
Variant	:	CVCK.E
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Every Sunday , date 1 and date 13
Macro in Document	:	Action, ActionDate, AutoOpen, AutoExec, FileTemplates, FilePrint, FilePrintDefault, stdClose, EditAutoText, ToolsMacro,
Macro in Normal	:	Action, ActionDate, AutoClose, DefeatAV, FileTemplates, FilePrint, FilePrintDefault, EditAutoText, stdOpen, ToolsMacro,
May I checking macro ?	:	No!, to dangerous
Destructive	:	Yes
Effect	:	• On date 1 or date 13 dialogbox will appear, and you lost all document you opened before, Im sorry ;( • On every Sunday print command will disable • Blocking ToolsMacro, FileTemplates, Tools Customize, virus will insert text into document!
Hint	:	Try type Foxz and press F3 if graphic FOXZ exist, becarefull Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV. Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

_____________

Back


WM. Visit

Original Name	:	Visit NoMercy WEB
Scanned as	:	CVCK.D
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy]
Variant	:	Not yet Found
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 13 every Month
Macro in Document	:	Action, ActionDate, AutoOpen, AutoExec, Stealth, StlhClose
Macro in Normal	:	Action, ActionDate, AutoClose, DefeatAV, FileTemplates, stlhOpen, ToolsMacro, Stealth
May I checking macro ?	:	Yes!, Not dangerous
Destructive	:	No
Effect	:	• On date 13 dialogbox will appear • Blocking ToolsMacro, FileTemplates, Tools Customize
Hint	:	Try type NoLogo and press F3 if graphic NoMercy exist,  you already infected  Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot:

_____________

Back


WM. Ono We

Original Name	:	Ono We
Scanned as	:	ShowOff.A
Origin	:	Yogyakarta, Central Java
Author	:	Foxz and CrazyMan, [NoMercy] we not claim the maker of this virus, but we can prove that we make this.
Variant	:	ShowOff.xx
Organization/Group	:	NoMercy
Stealth	:	No
Active	:	Date 13 every Month
Macro in Document	:	AutoOpen, Cfxx, Show
Macro in Normal	:	AutoClose, AutoExec, Ofxx
May I checking macro ?	:	Yes!, Not dangerous
Destructive	:	No
Effect	:	• On date 13 dialogbox will appear • If open/close show messagebox
Hint	:	You can delete this virus using ToolsMacro
ScreenShoot:

When date = 11 or 13

When Open document

Already infected	Before infected

_____________

Back


WM. Birthday

Original Name	:	Happy Birthday
Scanned as	:	ShowOff.C
Origin	:	Yogyakarta, Central Java
Author	:	Foxz and CrazyMan, [NoMercy] we not claim the maker of this virus, but we can prove that we make this.
Variant	:	ShowOff.xx
Organization/Group	:	NoMercy
Stealth	:	No
Active	:	Date 11 and 13 every Month
Macro in Document	:	AutoOpen, Cfxx, Show
Macro in Normal	:	AutoClose, AutoExec, Ofxx
May I checking macro ?	:	Yes!, Not dangerous
Destructive	:	No
Effect	:	On date 11 or 13 dialogbox will appear
Hint	:	You can delete this virus using ToolsMacro
ScreenShoot:

On date 11 or 13 you will see this dialog

_____________

Back


WM. NoMercy

Original Name	:	NoMercy
Scanned as	:	ShowOff.G
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy]
Variant	:	ShowOff.xx
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 13 every Month
Macro in Document	:	AutoOpen, Nomercy2, Show, ToolsMacro, Organizer, FileTemplates
Macro in Normal	:	AutoClose, AutoExec, Nomercy, ToolsMacro, Organizer, FileTemplates
May I checking macro ?	:	Yes!, but nothing happen
Destructive	:	Yes
Effect	:	• On date 13 All file with extension *.BAT, *.SYS In ROOT directory, *.GRP, *.DRV and *.DLL in WINDOWS directory and *.DRV, *.DLL in WINDOWS\SYSTEM directory will be delete! • Still on date 13 , virus will drop a file called NOMERCY.DLL In WINDOWS\SYSTEM\, and that file will become NOMERCY2.COM. • Still on date 13 , virus will overwrite Autoexec.bat for execute NOMERCY2.COM
Hint	:	Please delete or rename you DEBUG. EXE file, cause that file will execute this virus (or other virus) to make a new execution file. Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete NORMAL.DOT before do this!  Happy Hunting! Foxz
ScreenShoot:

When date 13 every Month

When checking macro

_____________

Back


WM. NoMercy II

Original Name	:	NoMercy II
Scanned as	:	ShowOff.AC
Origin	:	Yogyakarta, Central Java
Author	:	Foxz, [NoMercy]
Variant	:	ShowOff.xx
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 13 every Month
Macro in Document	:	AutoOpen, Nomercy2, Hayo, ToolsMacro, Organizer, FileTemplates
Macro in Normal	:	AutoClose, AutoExec, Nomercy, ToolsMacro, Organizer, FileTemplates
May I checking macro ?	:	No!, All file will be lost
Destructive	:	Yes
Effect	:	• On date 13 All file with extension *.BAT, *.SYS In ROOT directory, *.GRP, *.DRV and *.DLL in WINDOWS directory and *.DRV, *.DLL in WINDOWS\SYSTEM directory will be delete! • Still on date 13 , virus will drop a file called NOMERCY.DLL In WINDOWS\SYSTEM\, and that file will become NOMERCY2.COM. • Still on date 13 , virus will overwrite Autoexec.bat for execute NOMERCY2.COM
Hint	:	Try type wall and press F3 if graphic WALL exist, becarefull I warn You!! Please delete or rename you DEBUG.EXE file, cause that file will execute this virus (or other virus) to make a new execution file. Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot:

When User try Checking Macro :

On date  13 every Month :

_____________

Back


WM. Ririn

Original Name	:	Rr.Sixth Setyorini (Ririn)
Scanned as	:	ShowOff.R
Origin	:	Yogyakarta, Central Java
Author	:	Idban now Known as Foxz, [NoMercy]
Variant	:	ShowOff.xx
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 07 November
Macro in Document	:	AutoOpen, Ririn2, MetUltah, ToolsMacro, Organizer, FileTemplates
Macro in Normal	:	AutoClose, AutoExec, Ririn, ToolsMacro, Organizer, FileTemplates
May I checking macro ?	:	No!, to dangerous
Destructive	:	Yes, if you try to check her
Effect	:	• On 07 November virus will drop a file called RIRIN.DLL In WINDOWS\SYSTEM\, and that file will become RIRIN.COM • Still on date 13 , virus will rename AUTOEXEC.BAT to AUTOEXEC.RIN for execute RIRIN.COM • If you do checking macro. All file with extension *.BAT, *.SYS In ROOT directory, *.GRP, *.DRV and *.DLL in WINDOWS directory and *.DRV, *.DLL in WINDOWS\SYSTEM directory will be delete!
Hint	:	Please delete or rename you DEBUG.EXE file, cause that file will execute this virus (or other virus) to make a new execution file. Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot:

When Date 07 November :

If You do checking macro :

Title box always change depending what commend you use!

_____________

Back


WM. VisuaLand

Original Name	:	VisuaLand
Scanned as	:	GoldSecret.A
Origin	:	Jakarta, West Java
Author	:	Milky Wahyudi Widjaja
Variant	:	Not Yet founded
Organization/Group	:	VisuaLand [Claimer Macro Virus Group]
Stealth	:	No  (Why his claim the best virus ?)
Active	:	When you select About VisuaLand Technology GoldSecret
Macro in Document	:	AutoOpen, FileSaveAs, VisuaLand
Macro in Normal	:	AutoOpen, FileSaveAs, VisuaLand
May I checking macro ?	:	Yes
Destructive	:	No!
Effect	:	• Add About VisuaLand Technology GoldSecret below HelpAbout when you select About VisuaLand Technology GoldSecret you will meet DialogBox • When Infect your NORMAL.DOT a MessageBox appear
Hint	:	You can defeat this virus with ToolsMacro or FileTemplates Happy Hunting! Foxz
ScreenShoot :

When you select About VisuaLand Technology....

When infect your NORMAL.DOT :

_____________

Back


WM. VisuaLand.2

Original Name	:	VisuaLand. 2
Scanned as	:	Atom.xx
Origin	:	Jakarta, West Java
Author	:	Milky Wahyudi Widjaja
Variant	:	Atom.xx
Organization/Group	:	VisuaLand [Claimer Macro Virus Group]
Stealth	:	No
Active	:	13 EveryMonth and Second 13 every you save your file
Macro in Document	:	FileSaveAs, FileOpen, AutoOpen,VisuaLand, MyMesaage
Macro in Normal	:	FileSaveAs, FileOpen, AutoOpen,VisuaLand, MyMesaage
May I checking macro ?	:	Yes
Destructive	:	Yup
Effect	:	• Drop text file named MESSAGE.TXT • Delete all file in current directory on date 13 every month • If second 13, and you save your document, your document will passworded with "VisuaLand"
Hint	:	You can defeat this virus with ToolsMacro or FileTemplates Happy Hunting! Foxz
Note	:	This is the second claimer by The Asshole Milky
Screen Shoot:

After delete all file in current directory on date 13 every month you will meet this messagebox

Dropped file contain:

VisuaLand 2.0

Oleh: Milky Wahyudi Widjaya

GoldSecret (C) 1997 VisuaLand Technology

Virus  kedua  setelah  visuaLand  1.0 (rekayasa  Concept) Seperti biasanya saya selalu  hadir  kedepan  anda  untuk selamat, untuk segala sesuatu  yang  telah  anda  lakukan memang enak  menjadi  orang  seperti  anda,  tapi  jangan dikira  anda  ini  sedang  'happy',  anda  rupaya  sedang mengalami masa-masa krisis  pada  komputer  anda,  jangan menuduh teman anda atau pacar  anda  yang  melakukan  hal ini, tetapi itu merupakan ulah saya.

Virus ini  merupakan  hasil  rekayasa  virus  Atom,  yang dulunya saya akui bahwa  virus  tersebut  merupakan  saya yang buat, tetapi banyak orang sirik yang  ingin  merebutnya dari saya, tetapi sayalah yang  membuat  Atom,  versi ini merupakan versi perbaikan dari virus Atom

Bila anda ada waktu senggang, anda  bisa  menemukan  saya di rumah pada jam-jam tertentu,  saya  harapkan  hubungan dari anda.

Milky Wahyudi Widjaya

Jl. H Marzuki No. 37 RT 6/3

Jakarta - 11530

Indonesia

+62 21 5320382

EMail: milky@dnet.net.id

            milky@visualand.com

HPage: http://www.visualand.com/

In English mean:

[I only translate white text]

This Virus is modified from Atom virus,  a long time ago I make this virus, but many man take over from me, I'm the maker of Atom,  this version is update of  Atom Virus

_____________

Back


WM. Dzutaqshiri

Original Name	:	Dzutaqshiri
Scanned as	:	Dzt.A
Origin	:	Bandung, West Java
Author	:	Hikmat Sudrajat
Variant	:	Not Yet founded
Organization/Group	:	NONE
Stealth	:	No
Active	:	When you print your document
Macro in Document	:	AutoOpen, FileSaveAs
Macro in Normal	:	FileSave, FileSaveAs,
May I checking macro ?	:	Yes!
Destructive	:	Yes! You cant print until this virus remove
Effect	:	• Disable print when you try to print your document • Add comment DZT in FileSummaryInfo
Hint	:	You can defeat this virus with ToolsMacro or FileTemplates Happy Hunting! Foxz
ScreenShoot :

Text in statusbar, when you print your document :

This command is not available because a document window is not active

_____________

Back


WM. Krakatau

Original Name	:	Krakatau
Scanned as	:	KillOk.C
Origin	:	Yogyakarta, Central Java
Author	:	Original by CrazyMan, fixed by Foxz [NoMercy]
Variant	:	Not Yet founded
Organization/Group	:	NoMercy
Stealth	:	Yes !
Active	:	When you Try Checking Macro
Macro in Document	:	AutoOpen, NoMercy, FileTemplates, ToolsMacro
Macro in Normal	:	AutoOpen, FileTemplates, ToolsMacro
May I checking macro ?	:	No!, to dangerous
Destructive	:	Yes! If you do checking macro
Effect	:	• Protect document with random password TimeValue
Hint	:	Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
_____________

Back


WM. Rapi.xx

Original Name	:	@Rapi.Kom
Scanned as	:	Rapi
Origin	:	Malang, East Java
Author	:	Unknown
Variant	:	may be Bandung.xx, in the body the code look like Bandung
Organization/Group	:	Unknown
Stealth	:	Yes
Active	:	Everytime
Macro in Document	:	AutoOpen, RpAE, RpFS, RpFSA, RpTC, RpTM, RpFO
Macro in Normal	:	RpAO, AutoExec, FileSave, FileSaveAs, FileOpen, ToolsCostumize, ToolsMacro,
May I checking macro ?	:	No!, dont doit!!, is to dangerous all a will replace with #@
Destructive	:	Yes
Effect	:	• Drop file on drive C: called BACALAH.TXT • If you do use ToolsMacro and ToolsCustomize, all a will replace with #@ • If you open document (NORMAL.DOT was infected) you will see MessageBox
Hint	:	If you found BACALAH.TXT in your root directory, please scan all document!. Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

When You checking Macro :

When you Open document (NORMAL.DOT was infected) :

BACALAH.TXT contain :

"Assalamualaikum ..., maaf @Rapi.Kom mengganggu anda sebentar. Pesan ini aslinya bernama  PESAN.TXT  yang  muncul  di  root direktori  setelah  anda menjalankan Winword 6.0 yang templatenya (normal.dot)  telah  tertulari  macro  menjijikkan ini. Macro ini (sebelum @Rapi.Kom modifikasi)  berasal  dari  file data Winword 6.0 (*.doc) yang telah tertular macro ini. Bila file data tersebut  di pangggil (Open doc), maka macro secara otomatis menjalankan perintah-perintah macro lain nya,  yang antara  lain mengcopykan  diri ke global template (normal.dot), juga pada tanggal dan jam tertentu akan menghapus semua data di direktori tingkat 1, 2 dan 3 (kecuali Hidden direktori), menjengkelkan bukan ?!. Siapapun pembuatnya pastilah orang yang sirik !,  masih banyak perbuatan baik lain yang  bisa  kita kerjakan.         ... Malang,  @Rapi.Kom"

In English mean :

" Assalamualaikum ..., Sorry wait a second @Rapi.Kom distrub you. The original message named PESAN.TXT that dropped in root directory after you execute Winword 6.0 if normal.dot was infected by this asshole macro. This macro (before @Rapi.Kom modified) come from data file Winword 6.0 (*.doc) that was infected this macro. If that file execute (Open doc), macro automatically execute other viral code, i.e. make copy to global template (normal.dot), and in special date or special time I will delete all data in derectory level 1, 2 and 3 (expected Hidden directory), very good huh?!. The maker is maniac !, there much good thing that we can do.   ...Malang, @Rapi.Kom

_____________

Back


WM. Junkies

Original Name	:	Junkies
Scanned as	:	JunkFace.A
Origin	:	Yogyakarta, Central Java
Author	:	CrazyMan [NoMercy]
Variant	:	Always Change (this virus always change every infect)
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 11 every Month
Macro in Document	:	AutoClose, NoMercy
Macro in Normal	:	AutoClose, FileTemplates, ToolsMacro,
May I checking macro ?	:	Yes, but nothing happen
Destructive	:	No
Effect	:	• In date 11 you will see MessageBox • If you do use ToolsMacro and FileTemplates Nothing happen
Hint	:	Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

Appear in date 11 every Month

_____________

Back


WM. Junkies Update

Original Name	:	Junkies Update
Scanned as	:	JunkFace.B
Origin	:	Yogyakarta, Central Java
Author	:	CrazyMan [NoMercy]
Variant	:	Always Change (this virus always change every infect)
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 11 every Month
Macro in Document	:	AutoClose, NoMercy
Macro in Normal	:	AutoClose, FileTemplates, ToolsMacro,
May I checking macro ?	:	Yes, but nothing happen
Destructive	:	No
Effect	:	• In date 11 you will see MessageBox • If you do use ToolsMacro and FileTemplates Nothing happen
Hint	:	Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

Appear in date 11 every Month

_____________

Back


WM. Junkies 02

Original Name	:	Junkies 02
Scanned as	:	JunkFace.C
Origin	:	Yogyakarta, Central Java
Author	:	CrazyMan [NoMercy]
Variant	:	Always Change (this virus always change every infect)
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 11 every Month
Macro in Document	:	AutoClose, NoMercy
Macro in Normal	:	AutoClose, FileTemplates, ToolsMacro,
May I checking macro ?	:	Yes, but nothing happen
Destructive	:	No
Effect	:	• In date 11 you will see MessageBox • If you do use ToolsMacro and FileTemplates Nothing happen
Hint	:	Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

Appear in date 11 every Month

_____________

Back


WM. TenFaces

Original Name	:	TenFaces
Scanned as	:	Mercy.A
Origin	:	Yogyakarta, Central Java
Author	:	CrazyMan [NoMercy]
Variant	:	Not Yet Founded
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	When checking Macro
Macro in Document	:	AutoOpen, xxxxxLove, xxxxxAnik, xxxxx1109 (xxxxx = random string)
Macro in Normal	:	FileClose, FileTemplates, ToolsMacro, Organizer, ToolsCustomize xxxxxLove, xxxxxAnik, xxxxx1109 (xxxxx = random string)
May I checking macro ?	:	No!, You can type anymore
Destructive	:	Yes
Effect	:	• Insert Text in WIN.INI  • If you do use ToolsMacro and FileTemplates Keyboat layout change
Hint	:	If you found text in WIN.INI like below, scan all your document !! Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

When you try checking macro :

Text in WIN.INI:

[Intl]

Code_Name=WORDMACRO.TENFACES

Creator=Creator of NoMercy!

Dedicated=My Love, Anik AY

_____________

Back


WM. TenFaces II

Original Name	:	TenFaces II
Scanned as	:	Mercy.B
Origin	:	Yogyakarta, Central Java
Author	:	CrazyMan [NoMercy]
Variant	:	Not Yet Founded
Organization/Group	:	NoMercy
Stealth	:	Yes
Active	:	Date 11 every Month
Macro in Document	:	AutoExec, AutoOpen, xxxxx, xxxxx, xxxxx  (xxxxx = random string)
Macro in Normal	:	AutoClose, FileTemplates, ToolsMacro, Organizer, , xxxxx, xxxxx (xxxxx = random string)
May I checking macro ?	:	No!,
Destructive	:	Yes
Effect	:	• Insert Text in WIN.INI
Hint	:	If you found text in WIN.INI like below, scan all your document !! Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

When you try checking macro :

Text in WIN.INI :

[ Intl ]

I_am_here

Here_1

Here_2

Here_3

Here_4

Here_5

_____________

Back


WM. Toegoe

Original Name	:	Toegoe
Scanned as	:	KillOk.B
Origin	:	Yogyakarta, Central Java
Author	:	CrazyMan [NoMercy]
Variant	:	Not Yet founded
Organization/Group	:	NoMercy
Stealth	:	Yes !
Active	:	When you Try Checking Macro
Macro in Document	:	AutoClose, NoMercy
Macro in Normal	:	AutoClose, FileTemplates, ToolsMacro
May I checking macro ?	:	No!, to dangerous
Destructive	:	Yes! If you do checking macro
Effect	:	• No Effect Just prove that AntiHeuristics Work
Hint	:	Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
_____________

Back


WM. Vampire

Original Name	:	Vampire
Scanned as	:	CVCK.C
Origin	:	Yogyakarta, Central Java
Author	:	80e, with Our CVCK
Variant	:	Not yet Founded
Organization/Group	:	K-80e
Stealth	:	Yes
Active	:	Every Friday
Macro in Document	:	Action, ActionDate, AutoExec, AutoOpen, sthlClose, Stealth
Macro in Normal	:	AutoClose, ActionDate, DefeatAV, sthlOpen, FileTemplates, ToolsMacro, ToolsCustomize, Organizer, Stealth
May I checking macro ?	:	No, very dangerous
Destructive	:	Yes
Effect	:	• On Friday all data opened will be lost  • Blocking ToolsMacro, FileTemplates, Tools Customize, and if execute, you will access viral code. If user use 9x he will delete : C:\WINDOWS\START MENU\*.* C:\WINDOWS\TASKMAN.*  C:\WINDOWS\EXPLORER.*  C:\WINDOWS\WIN95.* If user use 3.xx he will delete : C:\WINDOWS\WIN.*
Hint	:	Try type vampire and press F3 if graphic VAMPIRE exist, becarefull Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

For WIN9x user :

For WIN 3.xx :

_____________

Back


WM. Strezz

Original Name	:	STREZZ
Scanned as	:	Strezz.A
Origin	:	Jakarta, West Java
Author	:	Dark Love & Lady Love
Variant	:	Not yet Founded
Organization/Group	:	[IVR] - Internation Virus Research
Stealth	:	Yes
Active	:	When print document
Macro in Document	:	AutoOpen, FilePrint, FileSaveAs
Macro in Normal	:	AutoOpen, FilePrint, FileSaveAs
May I checking macro ?	:	You cant do this, this command was remove by virus
Destructive	:	Yes
Effect	:	• When use FilePrint virus will inset text into document  • Blocking ToolsMacro, FileTemplates, Tools Customize, and if execute, you will access viral code.
Hint	:	Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot :

When you use FilePrint :

Text insert into  document:

STRESS '97

Special for my love by

The Free Hackers

Viroright © 1997 Internation Virus Research

If you have bugs, please call me and don't stress for it! I will back laler!

_____________

Back


WM. Surabaya

Original Name	:	Surabaya
Scanned as	:	Surabaya.A
Origin	:	Surabaya, East Java
Author	:	ICE - Man
Variant	:	Not yet Founded
Organization/Group	:	Lontong Micro Device
Stealth	:	Yes
Active	:	When start Word
Macro in Document	:	AutoOpen, FileSaveAs, Autoexec, ToolsMacro, FileTemplates, Plong
Macro in Normal	:	AutoOpen, FileSaveAs, Autoexec, ToolsMacro, FileTemplates, Plong
May I checking macro ?	:	You cant do this, this command was blocked by virus
Destructive	:	No
Effect	:	• When Start Word text print in status bar  • Blocking ToolsMacro, FileTemplates, Tools Customize, you will meet messagebox  • Plong macro contain text:  This Macro was created by : The ICE - Yes  Man             Allah Swt always be with All of You ....                               Surabaya, 09-09-1996 • Insert text in WIN.INI
Hint	:	Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScrenShoot :

When try to cheking Macro :

Text print in status bar :

"Lontong Micro Device © 1993 By ICE-Man"

Text in WIN.INI

[Author]

Name=TeBeYe`93 The ICE-Man"

_____________

Back


WM. Npad.xx

Original Name	:	D0EUNPAD
Scanned as	:	Npad
Origin	:	Bandung, West Java
Author	:	Unknown
Variant	:	Npad.xx
Organization/Group	:	UNPAD (Padjajaran University)
Stealth	:	No
Active	:	When virus has 23 time replicate
Macro in Document	:	AutoOpen
Macro in Normal	:	AutoOpen
May I checking macro ?	:	Yes
Destructive	:	No
Effect	:	• When virus has 23 time replicate, you will see text moving in status bar
Hint	:	If you sure only WM.Npad infect your Word, you can delete this virus from ToolsMacro, if you not sure, dont do it! Happy Hunting! Foxz
ScrenShoot :

Text moving in status bar:

D0EUNPAD94,  v.2.21,  ©  Maret  1996,  Bandung,  Indonesia

_____________

Back


WM. Phardera.xx

Original Name	:	Phardera
Scanned as	:	Phardera
Origin	:	Jakarta, West Java
Author	:	A.R.P. (tenang, cuma kita-kita yang tau)
Variant	:	Phardera.xx
Organization/Group	:	VBB
Stealth	:	Yes
Active	:	Date 14 and 31 every Month
Macro in Document	:	FileOpen
Macro in Normal	:	FileOpen
May I checking macro ?	:	No, this command removed by this virus
Destructive	:	No
Effect	:	• In date 14 or 31 this virus show MessageBox
Hint	:	Exit Word, delete NORMAL.DOT and dont open again your document until you remove that virus with your fav. AV.  Other way,... see my technics to removing macro, after you delete NORMAL.DOT, enter word again, dont open any document !!, then goto FileTemplates push button Organizer, chose Macro, Close one of NORMAL.DOT, open your file that suspect infected by MacroVirus, delete all macro found in that file! Remember, you must exit Word first and delete Normal.dot before do this!  Happy Hunting! Foxz
ScreenShoot:

When date 14 you will see this message :

When date 31 you will see this message :

_____________

Back


What is NVLR?

NVLR is NoMercy Virus Labs. Reports, this file contains much information about Indonesian macro virus, WHAT they are, HOW they are and, WHEN they are attack your document WORD.

I try to explain to you so... you will not panic anymore if you meet one of them!, that's what I want, cause little wrong can be big trouble!.

As you know I had much write macro viruses some of them very very dangerous I apologize (i.e. NoMercy I and II), by read information in this file, I am sure you can handle it if meet my virus.

_____________

Back


About Me

Here little bit of my biographi :

Real Name	:	Idban Secandri Putera
Nick Name	:	Foxz
Birthday	:	13 December 1975
Sex	:	Male
Mail	:	Foxz@usa.net
Hobbies	:	Surfing on the net, Making MacroVirus, Analize MacroVirus
Educations	:	Kindergarten "TK Wijaya Kusuma" Yunior school "SD YPP" Senior High School "SMP YKPP" High School "SMU Muhammadiyah I Yogyakarta"

_____________

Back


Comment about NVLR 01
Comment about NVLR 0.1

Take a look at what some other people write about NVLR 0.1

All quotes are printed as we received them. No corrections, no additions, no translations. (But we did cut the boring/personal parts)

Comments from users who do not wish to be listed here will be removed  just mail me.

"This is great !!, I can believe if virus writer do this"

fabs@essencial.com.br

"Apik !!"

vara@magaygy.maga.co.id

"Good job!!, keep it Up"

jprunner@hotmail.com

"Your NVLR  gonna be rival of Cicatrix's VDAT!!, good work brother!, beware Catrix!"

crazyman.nomercy@usa.net

"That's a good idea, keep it up Foxz"

aurodreph@defiant.ilf.net

"God damn, very good Foxz, continue it!"

lucifer.nomercy@usa.net

"I love your NVLR, that's All"

drusian@enter.it

"Keren oi..."

mastri@ugm.ac.id

"I love your NVLR, I'm waiting NVLR 02

geni@geocities.com

"Foxz, only one word : GREAT!"

madman@usa.net

"Oh..uh..oh''

tiu@rine.com.za

"I love it, when NVRL 0.2 Out ?"

d3024@AOL.com

"Welldone!!, tell me if NVLR 0.2 out"

ben@juno.com

"Bagus juga !"

awangk@hotmail.com

"Nothing, just thanks !"

freak@thepentagon.com

"Hi Foxz, great job thanks!!

Mel@AOL.com

"Belom tau dia... he..he..he"

Gurita [NoMercy]

"Thank's for your information"

claracom@hotmail.com

"Good"

spy@mail.aei.ca

"I think this is 1st Indonesian complete report, good job"

agus@rad.net.id

_____________

Back