Virus.MSWord.Gamble

Class Virus
Platform MSWord
Description

Technical Details


This is a stealth macro virus. It contains 3 modules and 11 functions:
AutoOpen, Gamble1, ToolsMacro, CommandButton2_Click, CommandButton5_Click,
Image1_Click, Label2_Click, Label3_Click, Label4_Click, UserForm_Click,
CommandButton1_Click.


On opening an infected file the virus disables the VirusProtection and
infects the global macros area (NORMAL.DOT), then on opening not infected
files the virus infects them.


The virus substitutes the Tools/Macro menu (stealth), on pressing the
“Create” button it displays the MessageBox:


Memory Allocation Error
Not Enough Memory To Complete The Request

On Mondays the virus displays the DialogBox:

Word Macro97 Virus “The Gambler” By Talon 1997
You System Is Infected By “The Gamble” Word Macro Virus
I Will Give You One Chance To Save Your Files, If You Can Guess The
correct Number between 1 And 10, I Will Return Your System To Your Control
If Your Wrong, Well We Won`t Go There. Do Not Not Turn Your System
Off. Your system FIles Have Been Encrypted With A Random Number, If This
Is Not Completed Your System Will Not Be Able To Reboot. Just Play Along
And Hope Your A Good Guess.
When Your ready To Play Press Here

On pressing the mouse button on Dialog the virus displays the MessageBox:

Trying To Cheat??
Are You Trying To Cheat?? One More Attempt like That And it’s Over

On pressing “HERE” button the virus ask for a number from 1 till 10. On
entering ‘5’ the virus display the MessageBox:

Your A Winner
Good Guess, It’s All Yours

In any other case the virus sets the password to current documents and
exits Windows.