Virus.MSWord.Schoo

0 0

This is an encrypted virus. It contains 7 macros:

Documents      NORMAL.DOT
GRBack         GetRid
AutoOpen       AutoOpen2
FileSave       FileSave
VerIdent2      VerIdent
FileSaveAs     FileSaveAs
BJTradeMark    BJTradeMark
ToolsSpelling  ToolsSpelling

It infects the global macros area on opening an infected document. It infects files that are saved with new name.

The virus adds new commands to Word auto-correction:

school     ->  schoo'
recognize  ->  reckonize
recognized ->  reckonized
assembly   ->  assemily
CHS        ->  Crowley High Schoo'

Since 28 of May 1998 the virus displays many MessageBoxes, for example:

Microsoft Word Virus Alert
Warning: The 'Big Johnson' Virus has been detected.

On 28 may 1998 it display the MessageBox:

Microsoft Word Virus Alert
Transferring control to virus subroutine:
Virus initializing...
It's the last day of school!

On all following days it displays the MessageBox:

Microsoft Word Virus Alert
Transferring control to virus subroutine:
Virus initializing...
School's out!