Virus.MSWord.Anak

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted macro virus. It contains four original macros that
are copied to five ones while infecting documents and NORMAL.DOT:


Documents NORMAL.DOT
Macro1 anakAE AutoExec
Macro2 AutoOpen anakAO
anakAO
Macro3 anakSA FileSave
anakSA
Macro4 anakSMU anakSMU

The virus infects the global macros area on opening an infected document
(AutoOpen) and writes itself to document on saving them (FileSave).


The virus defines new short cut key “Shift-Ctrl-F” and associates it with
Tools/Customize menu. To hide its macros (stealth feature) the virus
removes the File/Templates, Tools/Macros and Tools/Customize menus.


Starting from 25th of any month, starting from 14:00 the virus creates new
template, inserts the text into there:


…i n t r o d u c i n g…
anakSMU
Semarang, March 1997

The virus then registers itself in the system. To do that it creates the
ANAKSMU.BAT file, writes the commands to there and executes it:

@ECHO OFF
REM ———————————————————
REM anakSMU wont destroy your REGEDIT, Just wanna be there 🙂
REM email: anakSMU@TheOffice.net”
REM ———————————————————
ECHO REGEDIT4 > anakSMU.REG
ECHO [HKEY_CURRENT_USERSoftwareanakSMU] >> anakSMU.REG
ECHO [HKEY_CURRENT_USERSoftwareanakSMUanakSMU@TheOffice.net] >> anakSMU.REG
ECHO [HKEY_CURRENT_USERSoftwareanakSMU18.090 – Semarang] >> anakSMU.REG
START /MIN REGEDIT anakSMU.REG
EXIT

The virus then displays the MessageBox:

anakSMU
Yeah!, I wish I were anakSMU