Toten

Classification

Malware

-

-

Toten

Summary

For more information on macro viruses, see the description of WordMacro/Concept.

Documents infected with the Toten virus, contain two encoded macros: ReadMe (1834 bytes) and AutoOpen (223 bytes) and an infected NORMAL.DOT will contain two encoded macros as well: ReadMe (223 bytes) and DateiSpeichern (1834 bytes).

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

Toten encodes documents with a variable password. There is no chance for a user to open documents encoded by this virus. Toten is using the following passwords:

 
conditionpasswordsystem date
<= 31.12.96
 time + "TH" + datesystem date
<= 05.04.97
 "TH" + time + "DTH"system date
<= 10.05.97
 "TH" + date + timesystem date
<= 08.06.97
 time + date + "40"
system date
<= 29.08.97
 date + time + "TH"
system date
<= 20.12.97
 "02117335498" + "DTH"
system date
<= 31.12.97
 time + "TH" + date
system date
<= 05.04.98
 "TH" + time + "DTH"
system date
<= 10.05.98
 "TH" + date + time
system date
<= 08.06.98
 time + date + "40"
system date
<= 29.08.98
 date + time + "TH"
system date
<= 20.12.98
 "02117335498" + "DTH"
system date
<= 31.12.98
 time + "TH" + date
system date
<= 05.04.99
 "TH" + time + "DTH"
system date
<= 10.05.99
 "TH" + date + time
system date
<= 08.06.99
 time + date + "40"
system date
<= 29.08.99
 date + time + "TH"
system date
<= 20.12.99
 "02117335498" + "DTH"
system date
<= 31.12.99
 time + "TH" + date
system date
<= 05.04.00
 "TH" + time + "DTH"
system date
<= 10.05.00
 "TH" + date + time
system date
<= 08.06.00
 time + date + "40"
system date
<= 29.08.00
 date + time + "TH"
system date
<= 20.12.00
 "02117335498" + "DTH"
system date
<= 31.12.00
 time + "TH" + datesystem date
>= 01.01.00
 "TotenHosen" + time

The following text will be displayed on 02.01.2000:

Heute ist der 02.01.2000. Sie haben den Makrovirus: Die Toten HosenMakrovirus : Die Toten Hosen(DTH) aus DuesseldorfDer Virus wurd von M.N. aus Schwelm (BRD) am 08.06.1996 programmiert.
Ich bin ein echter Hosen Fan.
Das kennwort setzt sich zusammen aus Datum oder Zeit und den
buchstaben (TH) oder (TotenHosen) oder (40) oder (DTH)
Ha,ha,ha,ha,ha,ha,...

Variant:Toten.A, Toten.B

There are two variants known at present.

Date Created: -

Date Last Modified: -