Virus.MSWord.Cap

Technical Details

CAP – infection routine

AutoExec – calls the infection routine

AutoOpen – – // –

FileOpen – – // –

FileSave – – // –

AutoClose – – // –

FileClose – – // –

FileSaveAs – – // –

ToolsMacro – hides all macros (“stealth” routine)

FileTemplates – – // –

The virus not only disables ToolsMacro and FileTemplates menus, but also deletes the references to them in the File and Tools main menus. The virus also disables auto-macros. As a result it is not possible to disinfect this virus by using Word functions -it is not possible to delete macro viruses by creating new or running existing virus removing macros.

The virus emulates “FileSaveAs” while saving infected documents -and writes an empty document to disk.

The virus contains the following strings (comments):

C.A.P: Un virus social.. y ahora digital..
“j4cKy Qw3rTy” (jqw3rty@hotmail.com).
Venezuela, Maracay, Dic 1996.
P.D. Que haces gochito ? Nunca seras Simon Bolivar.. Bolsa !