Virus.MSWord.Ceefour

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted Word macro virus. It contains six macros: AutoOpen,
FileSave, FileOpen, FileTemplates, ToolsMacro, CFFSA.


It infects the global macros area on opening or saving an infected document
(AutoOpen, FileSave). It writes itself to the documents that are saved with
new name (FileSaveAs).


The virus disables the ToolsMacro and FileTemplates menus (stealth). While
opening a document the virus checks its name and disables its stealth
routine, if the name of document contains the sub-string “TONY”.


On April 1st the virus erases the files on the C: drive. The virus contains
the comments:


C-4 By Karl
“You are about to have a very bad day.”
“It looks like C4 in the mothers arm.”
“We are both professional, This is personal.”
“And when Alexander saw the bredth of his domain he wept for there
were no more worlds to conquer (benefits of a classical education)”
quotes from the masters!