Virus.MSWord.Akuma

Class Virus
Platform MSWord
Description

Technical Details

It is a dangerous macro virus. It infects global macro area on opening an
infected document. Other documents get infection also on their opening. The
infection routine finds virus procedures separately and stores them into
the disk file “C:CONT.DBL”. When victim document is infecting the routine
adds the code from this file to document without destroying document’s
macros, except “Document_Close” and “Document_Open” macros. It makes the
virus more stealthy.

In one case of two the virus changes document’s summary information:


Title = “Akuma Macro Carrier”
Author = “Akuma”
Keywords = “Mary Bitch”

The virus sets recent edited files list size to maximum – nine files (every
opened file MS Word adds in this list). On document closing the virus
checks the system date and if the day is 16, 17 or 18 executes payload
routine. This routine looking for file “C:MARY.LOG” that must have
“hidden” and “read only” attributes set and if it doesn’t found overwrites
all files from recent files list. The virus replaces content of this files
on text:


Something wonderful has happened, your PC is alive and even better but some
of your documents are infected by the Akuma virus.
Mary is simply a bitch and you, , are a stupid jerk and
lose some files.
Have a nice day.

After that the files are almost unrecoverable.