Virus.MSWord.Boom

Class Virus
Platform MSWord
Description

Technical Details


This virus is encrypted, it contains four macros: AutoOpen,
DateiSpeichernUnter, System, AutoExec. It infects the system on opening an
infected file (AutoOpen) and documents that are saved by FileSaveAs
(DateiSpeichernUnter).


On MS Word startup (AutoExec) the virus sets the System macro as triggered
at 13:13:13. At this time MS Word calls this macro and the virus runs its
trigger routine. It renames the menus:


Datei Bearbeiten Ansicht Einf�gen Format Extras Tabelle Fenster

to

Mr. Boombastic and Sir WIXALOT are watching you ! !

The virus then prints the string:

Mr. Boombastic and Sir WIXALOT : Don`t Panik,
all things are removeable !!! Thanks VIRUSEX !!!

then creates new template and writes the text to there:

Greetings from Mr. Boombastic and Sir WIXALOT !!!
Oskar L., wir kriegen dich !!!
Dies ist eine Initiative des Institutes zur Vermeidung und Verbreitung von
Peinlichkeiten, durch in der Öffentlichkeit stehende Personen, unter der
Schirmherrschaft von Rudi S. !

The virus also contains the strings:

Mr. Boombastic and Sir WIXALOT !!!