Virus.MSWord.Chaka

Technical Details

This is double-language virus, it supports both English and German Word
versions. It contains only one macro AutoOpen in infected documents, but
creates three macros ChAkA, FileOpen, DocClose in NORMAL.DOT while
infecting the global macros area.

The ChAkA macro is the copy of AutoOpen, it contains the infection routine.
Other macros (FileOpen, DocClose) call this infection routine. As a result
the virus infects the global macros area on opening an infected document
(AutoOpen) and writes itself to documents that are opened (FileOpen) or
when document’s window is closed (DocClose).

The virus contains the text string:

ChAkA! Nightmare Joker [SLAM]