Virus.MSWord.Jaja

0 0

This is an encrypted macro virus. It contains 10 macros:

AutoOpen, FileOpen, FileSaveAs, FilePrint, ToolsMacro, FileTemplates,
FormatStyle, ViewToolbars, ToolsCustomize, VictorWidjaja

When an infected document is opened (AutoOpen), the virus infects the global macros area. Then it writes itself to documents that are opened (FileOpen) or saved with a new name (FileSaveAs). The ToolsMacro and FileTemplates are the stealth macros - they disable the corresponding Word menus.

On printing a document (FilePrint) the virus erases its contents and inserts the message:

 ------------------------------------------------------------ 
|             Welcome to Victor Widjaja Virus                |
|Your computer has been totally infected by    ''Victor Widja|
|                ja'' WordMacro Virus                        |
|                Don't go anywhere !!!                       |
|        I'll be back soon to DESTROY your disk data !!      |
|              Copyright  1996 Virus Research Labs.          |
 ------------------------------------------------------------ 

Then the virus prints the message to the status line:

[ Welcome to Victor Widjaja `WordMacro' Virus - Programmed & Created
by Victor Widjaja the HACKER - Virus Research Labolatory ]

On November 1st the virus prints the same message, then displays the MessageBox:

Attention
Victor Widjaja lives in your PC now

The virus then checks the system timer, and if current seconds counter is equal to 1 or 11 the virus calls the disk erasing function:

Format C: /U /C /S /AUTOTEST > NUL