Class Virus
Platform MSWord

Technical Details

The virus contains five macros: AutoExec, AutoOpen, DLLError, ToolsMacro,
ToolsCustomize. It replicates on opening documents.

In the WIN.INI file in the [Formater] section in the Activated string the
virus keeps the counter that is increased on each loading Word with
infected NORMAL.DOT.

On starting Word on August 20 the virus creates a new document and runs the
text there:

Word Macro Virus Formater!!! by Formater . This is my birthday!
I’m <1998 minus current year number> years old! Don’t try to find me…

On entering the Tools/Macro or Tools/Customize menu the virus displays the

Cannot find FORMATER.DLL. Windows
needs this file to run winword.exe

On entering the same menus on August 20 the virus displays the InputBox and
waits for “Formater” input, otherwise it exits the Windows:

I’m a Word Macro Virus! I said: ‘Don’t try to find me!!!’ You didn’t
listen to me! Enter my name, or I will quit from Word without saving
documents! (do not press Cancle)

The virus contains the comments:

_____ ___ ____ __ __ _ _____ _____ ____
| ___/ _ | _ || / || / ||_ _|| ____|| _ || ||_ || || || || ||_) || ||/|| || / _ || || || _|| || ||_) ||

Find out the statistics of the threats spreading in your region