The virus contains seven macros in one module “Cipher”: AutoNew, AutoOpen,
AutoClose, cphrdoc, hideb, WindowsDirectory, and spreadIB. It replicates upon
document creating, opening and closing (AutoNew, AutoOpen, AutoClose).
Depending on the system random counter, the virus sets the password
“MisterCipher” on a current document or displays the following MessageBox:
I say to you that it’s
On Friday the 17th, on the 31st of the month (excluding those with less days), and on the 25th of April, the virus drops a file
infected by the the “Italian.578” DOS virus.
Upon closing documents on the 25th of April, or depending on the system random counter,
the virus encrypts the text in the current document and displays the following MessageBox:
I want to say to you: L’Italia una ed indivisibile e c’ la morte per
chi la divide!!!!!…..
Are you angry because you lost your document?+; Kill Bossi, the fault is his
Mister Cipher reigning