Class Virus
Platform MSWord

Technical Details

This is a dangerous macro-virus. It uses an ordinary way to spread – it
infects the global macros area upon opening an infected document, other documents
get infected upon their opening or closing.

The virus has many payload routines. Each of them is activated only one day
per month:

1 – the virus inserts in document the text:

      Alamat brought to you by Lucky Warrior

2 – disables “Table” menu command

3 – disables “Help” menu command

4 – deletes all files in root folder of drive C:

5, 25, 27 – deletes all files in folders:

     C:Program FilesNorton~1*.*

6 – deletes all files in “C:Windows” folder

7 – saves documents with password “Alamat”

8 – prints document with added note “Your’re infected with the Alamat virus!”

9 – changes Windows registerd onwer name to “Lucky Warrior”

10, 30 – deletes all files in “C:Windows” and “C:Winnt” folders

11 – deletes one character at cursor position.

12 – opens “” site

13 – displays Office Assistant with message:

     Ms Word is suffering from unknown virus!

14 – modifies the system registry to display a message before system log-on:

     Lucky Warrior
     Welcome to the world of Alamat!

15 – replaces all “of” words by “Alamat” and then deletes commands “Replace” from menu

16 – hides Office Assistant and mouse cursor

17 – changes Word window caption to “Alamat”

18 – disables “File” menu item

19 – exits Word just after document open

20 – deletes all files in “C:Progra~1System” folder

21 – disables “Edit” menu command

22 – disables “View” menu command

23 – disables “Insert” menu command

24 – disables “Format” menu command

26 – exits Windows

28 – changes Word user information:

     UserName     = "Lucky Warrior"
     UserInitials = "LW"
     UserAddress  = "Bgy. Tiguib, O.E.S."

29 – disables “Window” menu command

Find out the statistics of the threats spreading in your region