Class Virus
Platform MSWord

Technical Details

The virus contains seven macros in one module “Cipher”: AutoNew, AutoOpen,
AutoClose, cphrdoc, hideb, WindowsDirectory, and spreadIB. It replicates upon
document creating, opening and closing (AutoNew, AutoOpen, AutoClose).

Depending on the system random counter, the virus sets the password
“MisterCipher” on a current document or displays the following MessageBox:

Time Signal
I say to you that it’s

On Friday the 17th, on the 31st of the month (excluding those with less days), and on the 25th of April, the virus drops a file
infected by the the “Italian.578” DOS virus.

Upon closing documents on the 25th of April, or depending on the system random counter,
the virus encrypts the text in the current document and displays the following MessageBox:

I want to say to you: L’Italia una ed indivisibile e c’ la morte per
chi la divide!!!!!…..
Are you angry because you lost your document?+; Kill Bossi, the fault is his
Mister Cipher reigning

Find out the statistics of the threats spreading in your region