Virus.MSWord.Crow

Class Virus
Platform MSWord
Description

Technical Details


This brazilian virus contains three macros: autoOpen, CROWFuck,
ArquivoSalvar. It replicates on opening and closing documents (autoOpen,
ArquivoSalvar auto-macros).


The virus code contains many effects:


  1. the virus deletes macros accessing menu items,
  2. on the 5th of any month starting from April it inserts the strings into the
    document’s summary info:

    Title = The CROW_Fuck!!!
    Subject = nothing
    Author = The Best Virus Creator
    Comments = Surprise!!! You Die!!!!!
    VOCÊ FOI INFECTADO PELO VIRUS The CROW_Fuck – Macro – Fuck Microsoft,,
    Mcafee, ThunderByte and more!!!
    !í!í! Bye Bye LAMMER !í!í!

  3. on 8th of any month starting from May it adds a file erasing commands to
    the C:AUTOEXEC.BAT file and then displays the MessageBox:

    The CROW_Fuck – Macro virus
    Surprise!!! You Die!!!!!!
    > > Brazil < <

  4. if system minutes > 57 , the virus prints to the status bar the running
    string:

    The CROW_Fuck – Brazil – 97 !!!!!

  5. if there are more than 50 words in document, the virus insert a space at
    random selected place. Depending on random counter it also insert into
    document the “CROW” word.
  6. on Fridays the virus insert the text into document:

    CROW_Fuck – The Complete Macro Vírus
    Este vírus é dedicado a todos que pensam que o povo do terceiro mundo não
    é capaz de criar coisas que tenham utilidade; aos Lammers, porque sem
    eles não daria para se disseminar o vírus; à Microsoft, por tornar tão
    fácil a pirataria; à Mcafee, por seu Vir
    usScan ser totalmente burro e fácil de se enganar.
    See Ya
    The CROW