36 Error while initializing virus scan engine. %u(%x)
50 Start virus scan
51 Virus scan finished
52 Abort virus scan
53 Database version: %02d.%03d.\n
54 Database date: %d.%d.%d.\n
55 \nScan areas:\n
56 Unregistered (demo) version, it can only remove a few types of viruses.\nFor registration contact your distributor, or the address below:\n\nVirusBuster Ltd.\nH-1031 Budapest, Kalászi út 11.\nPhone/fax: +36-1-430-8350, +36-1-242-2130\nE-Mail: mail@vbuster.hu
57 Scan duration: %02d:%02d:%02d\n
58 - recursive\n
59 - not recursive\n
1001 Attention!
1002 No scan area defined.\nPlease specify at least one!
1003 Edit scan area
1004 No disk read method selected!\nDisk read through DOS calls set.
1005 Do you really want to exit?
1006 Exit program
1007 Continue using the program
1008 The virus can also be removed in DEMO mode!
1009 The virus CAN NOT BE removed in DEMO mode!
1010 File %s is inaccessible!\n
1011 The level of heuristic analysis is quite sensitive, so files might be considered as if they were infected by a virus, even if they are not!\n\nDo you want this message to be displayed in the future ?
1012 Yes, next time too.
1013 No, next time do not.
1014 Not enough memory to display the list of viruses!
1015 Close the virus list
1016 Registered version
1017 Unregistered version
1018 Demo version
1019 The defined search pattern is too long.\nPlease specify a shorter one!
1020 Not registered!
1021 Registration is expiring!
1022 Registration has expired!
1023 Registration has expired!
1024 Registered!
1025 Temporarily registered!
1026 Registration failed!\nPlease repeat it with the correct key!\n(Pay attention to spelling/typing!)
1027 Does not register, try again...
1028 The program is temporarily registered. The code is valid only until you exit.
1029 The program is temporarily registered.
1030 The registration has expired.
1031 Please ask for a new registration key!
1032 The registration has expired!\nPlease renew your registration!
1033 Please renew your registration!
1034 Registration completed.
1035 Registration completed.
1036 The disinfection of the virus under this operating system is impossible!\nPlease reboot your computer from a clean DOS system disk,\nand try to remove the virus with the DOS version of VirusBuster!\n
1037 The operating system does not allow removing the virus.
1038 <general description>
1039 During the heuristic analysis the program examines the virus-like behavior of the executable code from several points of view.\nEvery heuristic flag represents the presence of a behavioral type. The more flags assigned to the examined code the higher the probability is that the code contains a virus.\nSome 'tricky' programs may use suspicious code WITHOUT CONTAINING ANY VIRUSES!
1040 #: DECODER
1041 The program probably contains a self-decoding routine. Several copy protected programs work this way! Many viruses protect themselves in a self-encoding method.
1042 !: INVALID CODE
1043 Illegal operation code or jump outside the code. The program is probably damaged.
1044 ?: INVALID EXEHDR
1045 The program has an invalid EXE header. Many viruses alter the EXE header incorrectly during the infection!
1046 h: HIDDEN OR SYSTEM
1047 Hidden file. If you do not know the function of this program, it may be a Trojan horse!
1048 p: PACKED
1049 Compressed file. It needs to be decompressed for full examination!
1050 w: WIN OR OS/2 HEADER
1051 This program is a native Windows or OS/2 application.
1052 x: SUSP. EXEHDR
1053 The entry point of the EXE program points at the final relocation data. (Usually outside of the original code!) This is the most typical characteristic of a virus infection.
1054 A: SUSP. MEM. ALLOC
1055 The program uses a non-standard way to search or allocate memory. Specific not only of several type of viruses, but many diagnostic and HMA programs too!
1056 B: BACK TO ENTRY
1057 After the whole program is executed, it jumps back to the entry point. In most cases the virus tries to execute the original program this way.
1058 D: DISK WRITE
1059 Direct disk write. The usual (non disk maintainer) utilities do not write directly to the disks immediately after the program starts.
1060 E: FLEXIBLE ENTRY
1061 The program is trying to determine it's own entry point. 50% of the known viruses operate the same way!
1062 F: SUSP. FILE ACCESS
1063 Instruction sequence, that is very similar to the infection mode of viruses. Attempt to create or modify a file.
1064 G: GARBAGE CODE
1065 The program contains useless code sequences. Several viruses create such sequences to make detection more difficult. This might also occur in poorly designed programs...
1066 J: SUSP. JUMP
1067 The program jumps several times before the original initializing code, or initializes after an indirect jump. Usual programs do not contain such instructions.
1068 K: UNUSUAL STACK
1069 The EXE program uses an unusual stack or the stack begins at an odd address. Many viruses contain errors, resulting in the creation of a faulty stack.
1070 L: LOADING TRAP
1071 The program is trying to trap other programs. If the program is memory resident too (M), it is examining the execution of other software. Several viruses use this method for infection, but many virus protection tools use the same method to eliminate virus attacks.
1072 M: RESIDENT
1073 A kind of program, which redirects many important interrupts to itself.\nIf the function of the program is unidentifiable, it may be suspicious!
1074 N: SUSP. EXTENSION
1075 .EXE file with COM contents or .COM file with EXE contents!
1076 O: CODE OVERWRITE
1077 The program is self-modifying, but does not seem to be self-decoding.
1078 R: RELOCATOR
1079 Code sequence, that is typical in viruses. It modifies CS:IP to relocate the virus code according to the actual state. Usual programs do not need this procedure!
1080 S: SEARCH EXEC
1081 The program searches for .COM or/and .EXE files!
1082 T: INVALID TIMESTAMP
1083 Bad file date! Many viruses mark infected files with an invalid date to avoid multiple infection.
1084 U: UNDOCUMENTED INT
1085 The program uses undocumented DOS function or interrupt calls. Many legal programs work the same way! Viruses use this method to communicate with their own resident part.
1086 Y: INVALID BOOT
1087 The BOOT sector of the disk does not confirm to the IBM standard. It may contain a virus.
1088 Z: EXE COM DETERMINATE
1089 The program is trying to determine whether a file is an EXE or a COM. This is a virus-like activity, but for many other programs, such as debuggers, executable compressors or converters (EXE2BIN) this procedure is necessary.
1090 *: DIFFUSE BEHAVIOUR
1091 The program contains instruction sequence(s), which are suspicious, and are similar to viruses.
1092 Off!
1093 normal
1094 strong
1095 sensitive
1096 paranoid
1097 Save log file
1098 Log file:
1099 The name of the log file
1100 Save the log into the file defined
1101 The log will not be saved
1102 Save settings
1103 Configuration file:
1104 The name of the configuration file
1105 Save settings into the file defined
1106 The configuration will not be saved
1107 Unregistered software copy!\n
1108 Registration expired on %d.%d.%d.!\n
1109 Registration will expire in 1 month.
1110 Registration expired on %d.%d.%d.!\n.!
1111 The virus database is rather old!\n For an updated version, contact your distributor!\n
1112 \nPress any key to continue...
1113 Warning!
1114 Unsupported operating system. The software can not be executed!\n
1115 \nNo readable disk in drive %c:!\n
1116 Read error on\n%s!
1117 Abort the current operation
1118 Retry the current operation
1119 Ignore the error and try to continue
1120 Error:
1121 --- Continue? (y: yes):
1122 y
1123 Repeated option: %s\n
1124 Unknown option: %s\n
1125 Invalid file mask!\n
1126 Invalid or inaccessible path: %s\n
1127 Too many paths!\n
1128 Incompatible options: %s\n
1129 No floppy drive defined!\n
1130 No disk access method enabled!\n
1131 Option %s can not be recognized in this case\n
1132 The parameter of the %s option is too long!\n
1133 The parameter of the %s option is too large!\n
1134 The parameter of the %s option is not a number!\n
1135 ESC to exit
1136 Cannot write into the log file.
1137 \n@EThe virus removal was unsuccessful,\n@Ethe system still contains viruses.\n
1143 The scan process can be stopped by pressing ESC
1144 Attention!
1145 To scan through files and directories, please enable the appropriate scan areas.
1146 The scan cannot be performed in the defined scan area.
1147 \nPlease insert next floppy disk, and press any key when ready.\n
1148 Cylinder %u. restored.\n
1149 @XCylinder %u. restored.\n
1150 D: disinfect
1151 A: disinfect all
1152 C: continue
1153 B: abort
1154 Y: yes
1155 N: no
1156 L: later
1157 X: exit
1158 R: retry
1159 -: non-interactive
1160 VSK internal error: %04x!
1161 \nContinue?
1162 Do you really want to abort the disinfection of viruses?
1163 Do you really want to abort the scan for viruses?
1164 Attention!
1165 Abort scan
1166 Continue scanning
1167 Aborting disinfection in this phase is dangerous. It may cause data loss or other unpredictable errors!\nDo you still want to abort the disinfection?
1168 Abort the disinfection process immediately
1169 Continue disinfection process
1170 Abort when the disinfection process ends
1171 Continue
1172 Abort
1173 \n@VT0 found!\n\nFound at location:\n@40P0\n\n@VT0 name: @V\n
1174 \nThe @VT0 is @I
1175 removable.
1176 can not be removed.
1177 can not be removed from compressed file.
1178 \nWhen the program exits, please \npress the RESET button on your machine\nand reboot the system from an\nuninfected DOS system disk.\nWhen done, run VirusBuster again.
1179 Unregistered (demo) version, it can only remove a few types of viruses.\nFor registration contact your distributor, or the address below:\n\nVirusBuster Ltd.\nH-1031 Budapest, Kalászi út 11.\nPhone/fax: +36-1-430-8350, +36-1-242-2130\nE-Mail: mail@vbuster.hu
1180 Continue scanning
1181 can not be read!
1182 can not be written!
1183 write protected!
1184 not accessible!
1185 Retry
1186 Skip
1187 Abort
1188 Sorry, this virus can only be removed with the registered version of the software!\n
1189 \nSuspicious file\n\nFile name:\n@40P0\n
1190 \nThe sensitivity of heuristic analysis is
1191 normal.
1192 strong.
1193 paranoid!
1194 sensitive!
1195 \nHeuristic flags: @H
1196 \nMethod of removal: file
1197 delete
1198 rename
1199 move
1200 \nMacro heuristic flags: @M
1201 \nMethod of removal:
1202 macro delete
1203 document rename
1204 document move
1205 The master boot record of @P: is multiply infected, there is no way to automatically restore original conditions!
1206 The boot sector of @P: infected is is multiply infected, there is no way to automatically restore original conditions!
1207 The boot sector of @P: is multiply infected!\nThe repair method: new boot sector generation.
1208 \nTo eliminate the virus infection, please contact a virus specialist!
1209 \nWhen the program exits, please \npress the RESET button on your machine\nand relboot the system from an\nuninfected DOS system disk.\nWhen done, run VirusBuster again.
1210 can not be removed under this operating system.
1211 @V virus found in the boot sector of @40P!\nThe repair method: new boot sector generation.
1212 @V trojan horse found in the
1213 ╔═╗║ ║╚═╝
1214 ┌─┐│ │└─┘
1215 ╠
1216 ╣
1217 ╦
1218 ╩
1220 Selected directories:%14d
1221 Current files:%21d
1222 Viruses found:%4d Disinfected:%4d
1223 Last virus found:
1224 Mapping directory tree...
1225 Current directory:
1226 <none>
1227 Drive: %s: %s
1228 Created on --/--/----.
1229 Selected directories: %d
1230 Created on %02d/%02d/%d.
1231 Label:
1232 \n── Log file opened:
1233 virus!\n
1234 sequence!\n
1235 mutant!\n
1236 The program does not support this version of the virus database.\nFor a newer version of the database contact your software distributor!
1237 Can not open the virus database
1238 Document handler module not initialized
1239 The file is not a Word or Excel document
1240 File contains blocks that are too large
1241 The file is not a standard Word or Excel document
1242 File contains an invalid block number
1243 MS Word for Windows v2.0 document
1244 Document contains an invalid or damaged macro definition
1245 Document's content is damaged
1246 Document contains invalid macro name
1247 Internal buffer too small
1248 <general description>
1249 The phrase after the macro heuristic flag indicates the importance of that flag:\n (important) : the flag indicates a virus\n (supplementary): the flag indicates harmful activity\n or a stealth virus\n (informative) : informative flag\nThe document is very likely infected by a virus, if at least one important flag is displayed.
1250 A: MACRO COPY (important)
1251 Copying macros into the document or the global macro template. In most cases viruses infect Word or documents this way.
1252 B: ORGANIZER (important)
1253 To copy its own macros, the virus can also use the Macro organizer feature of Word.
1254 C: CREATE (important)
1255 Primarily used by polimorphic viruses to create the altered macro code.
1256 D: ADD TEMPLATE (important)
1257 It adds a template or WLL to the global template. Using this method viruses can create a global template without infecting the original global template. This method is often used to install Word's external tools, so it can cause false virus alarms.
1258 E: FORMAT (important)
1259 To infect a document, the virus must convert the document into template format first.
1260 F: COUNT MACRO (supplementary)
1261 Querying the number of macros in the template.\nThis function is suitable for querying all the macros in the template, and for handling them.
1262 G: MACRO NAME (supplementary)
1263 Querying the name of macros in the template\nViruses use this function to search for macros and to identify them.
1264 H: DELETE (supplementary)
1265 Polimorph viruses use this function primarily to delete temporary macros. Some macro virus protection software also uses it to remove found macro viruses.
1266 I: SAVE AS (supplementary)
1267 The virus must save the infected document as a template. Only this function can be used to do this. It indicates a virus only together with the 'E' flag (FORMAT).
1268 J: FAST SAVE (supplementary)
1269 Turns on the Quick save function. The virus then can save the infected document without being noticed.
1270 K: AUTO MACRO (supplementary)
1271 Turns on the execution of auto macros. These are essential to activate the virus.
1272 L: SAVE WINDOW (supplementary)
1273 Saves the active window before creating a new macro. Polimorph viruses use this function to hide their activity.
1274 M: SCREEN UPD. (supplementary)
1275 Turns off screen refresh. Hides the visible activities of the virus.
1276 N: GLOBAL SAVE (supplementary)
1277 To hide the infection process of the global template, many viruses turn off the warning message before saving template in Word.
1278 O: DISABLE INPUT (supplementary)
1279 During the infection it is impossible to interrupt the process.
1280 P: RENAME MENU (supplementary)
1281 To hide the infection, some viruses rename the menu items which can query the settings of macros and menus.
1282 #: MACRO INSERT (important)
1283 Macro creation and fill-up. Polimorph viruses must create a temporary macro for spreading. This macro contains usually the altered or decoded virus code. The temporary macro will then be renamed and deleted.
1284 a: PASSWORD (supplementary)
1285 Defines a read password on the document. Some viruses apply it as a destructive routine.
1286 b: INSERT TEXT (supplementary)
1287 Insert text into the document.
1288 c: SHELL (supplementary)
1289 Execution of a DOS or Windows program. Macro viruses, that contain other file viruses apply this instruction to spread the contained virus code. In addition it may also occour as a destructive routine, or in every macro which uses external programs.
1290 d: KILL (supplementary)
1291 File delete.
1292 e: WRITE (supplementary)
1293 Direct write to a file.
1294 f: PRINT (supplementary)
1295 Direct write to a file.
1296 g: RMDIR (supplementary)
1297 Remove directory.
1298 h: SETATTR (supplementary)
1299 Change file attributes.
1300 i: DECLARE (supplementary)
1301 Prepare to use a function from a DLL or WLL. By using this method all of the Windows functions can be accessed.
1302 j: UNLOCK (supplementary)
1303 Eliminate the protection of document.
1304 k: ONTIME (informative)
1305 Launch a macro at a given time. Viruses use this function for delayed infection or to damage documents.
1306 l: PROTECTION (informative)
1307 Rewrite field protections in the document.
1308 m: REMOVE PROT (informative)
1309 Remove protection from fields.
1310 n: ENVIRONMENT (informative)
1311 Query environment variable.
1312 Bad CRC value
1313 Unsupported compression method
1314 Error during decompress
1315 Broken archive
1316 Password protected archive
1317 @EError!
1318 @O@P: @S'@V' @VT0!
1319 @ANo recognizable viruses.\n
1320 @ARemoved.
1321 @ANot removed.
1322 @AThe file was deleted.
1323 \n@EVSK running error.
1324 @AThe file was moved to the quarantine.\n
1325 @AThe file was renamed.
1326 @O@P: @A'@V' immunizer.
1327 @O@P: packed with @A'@V', the file contents are not accessible.
1328 @O@P: @Sfile is suspicious! @AHeuristic flags: @X@H.
1329 @O@P: @Sdocument is suspicious! @AHeuristic flags: @X@M.
1330 Scanning: @50P
1331 file
1332 in file
1333 :\ partition's boot record
1334 :\ in partition's boot record
1335 : phisycal drive's MBOOT record
1336 : in phisycal drive's MBOOT record
1337 memory
1338 in memory
1339 directory
1340 in directory
1341 compressor
1342 compressor
1343 immunizer
1344 immunizer
1345 virus
1346 virus
1347 sequence
1348 sequence
1349 mutant
1350 mutant
1351 trojan program
1352 trojan program
1353 killable
1354 not killable
1355 can't be removed from compressed files
1356 none.
1357 all.
1358 Internal error!Old code: 0X%04X.Location: @P
1359 Internal error!New code: %d.
1360 \nScan areas:\n
1361 partition table
1362 boot sector
1363 subdirectories
1364 files
1365 compressed files
1366 \nSelected files:\n
1367 programs
1368 documents
1369 spreadsheets
1370 MS access
1373 \n\nScan:
1374 \nheuristics:
1375 \nmacro heuristics:
1376 quick
1377 thorough
1378 full
1379 off
1380 normal
1381 strong
1382 paranoid
1383 sensitive
1384 \nDisc access methods:
1385 BIOS calls
1386 Device driver
1387 OS calls
1388 \n\nNon-removable viruses:
1389 \nSuspicious programs:
1390 \nSuspicious documents:
1391 Report only
1392 Rename file
1393 Move to quarantine
1394 Delete
1395 Delete macros
1396 \nother pattern:
1397 \nSearch pattern:\n
1398 \n\nQuarantine:
1399 \ntemporary directory:
1400 @TY. @TMS @TD.
1401 @TH:@TM:@TS
1402 @TH:@TM:@TS
1403 January
1404 February
1405 March
1406 April
1407 May
1408 June
1409 July
1410 August
1411 September
1412 October
1413 November
1414 December
1415 @XVirusBuster\n@O▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀\n@O(c) 1988-2001. VirusBuster Kft. All rights reserved.\n World Wide Web URL: http://www.vbuster.hu\n\n@OVirus database: @LVV - @LVD\n\n
