Kaspersky Threats — GamesVirus

Class

Platform

Description

Technical Details

This virus contains seven macros in one module “GamesVirus”: AutoExec,
AutoOpen, FileSaveAs, FileTemplates, PayLoad, ToolsMacro, ViewVBCode.

It infects the global macros area on opening an infected document and
infects documents on opening or saving with new name.

On entering the Tools/Macro and File/Templates menus the virus displays the
MessageBoxes:



Microsoft Word

accès refusé!!!!

Microsoft Word

Fonction Sub inconnu

Depending on the system date and time the virus manifests itself in several
ways. If current number of seconds is 1, the virus writes to the Subject
field in FileSummaryInfo the text:



GamesVirus est avec vous, HAHA      !!

If current number of minutes is 1, the virus writes the string to the
StatusBar:



Remerciement à GamesVirus et à son auteur: ZeMacroKiller98

On tje 1st of any month it calls the Payload macro which displays several
MessageBoxes and user forms. Depending on user’s input the virus display
MessageBoxes, erases system files, appends to the end of C:AUTOEXEC.BAT
file instructions that format the hard disk, or in cycle draws the text in
the status line:



Tu es le meilleur, bravo de la part de GamesVirus et de son auteur….

Class	Virus
Platform	MSWord
Description	Technical Details This virus contains seven macros in one module “GamesVirus”: AutoExec, AutoOpen, FileSaveAs, FileTemplates, PayLoad, ToolsMacro, ViewVBCode. It infects the global macros area on opening an infected document and infects documents on opening or saving with new name. On entering the Tools/Macro and File/Templates menus the virus displays the MessageBoxes: Microsoft Word accès refusé!!!! Microsoft Word Fonction Sub inconnu Depending on the system date and time the virus manifests itself in several ways. If current number of seconds is 1, the virus writes to the Subject field in FileSummaryInfo the text: GamesVirus est avec vous, HAHA !! If current number of minutes is 1, the virus writes the string to the StatusBar: Remerciement à GamesVirus et à son auteur: ZeMacroKiller98 On tje 1st of any month it calls the Payload macro which displays several MessageBoxes and user forms. Depending on user’s input the virus display MessageBoxes, erases system files, appends to the end of C:AUTOEXEC.BAT file instructions that format the hard disk, or in cycle draws the text in the status line: Tu es le meilleur, bravo de la part de GamesVirus et de son auteur….

Virus.MSWord.GamesVirus

Technical Details