Kaspersky Threats

Class

Platform

Description

Technical Details

This is an encrypted macro-virus containing three macros: AutoOpen,
FileSaveAs, OhYes. It replicates itself when documents are opened or saved
with a new name. It identifies itself in documents according to the document variable
“Giggle=OhMyGod”.

On each day except Tuesday, the virus, depending on the random system counter,
erases the files on the C: drive or replaces the strings:



By – It’s Not Monday any more

^d – Error!

B  – x

^# – #

^w – x

After deleting files, the virus displays one of the MessageBox’es:



Space Virus More space for the user

Sorry Self-destruct is in action

Windy

An error has occured you must re-start windows

This is the OBAY Virus

Class	Virus
Platform	MSWord
Description	Technical Details This is an encrypted macro-virus containing three macros: AutoOpen, FileSaveAs, OhYes. It replicates itself when documents are opened or saved with a new name. It identifies itself in documents according to the document variable “Giggle=OhMyGod”. On each day except Tuesday, the virus, depending on the random system counter, erases the files on the C: drive or replaces the strings: By – It’s Not Monday any more ^d – Error! B – x ^# – # ^w – x After deleting files, the virus displays one of the MessageBox’es: Space Virus More space for the user Sorry Self-destruct is in action Windy An error has occured you must re-start windows This is the OBAY Virus

Virus.MSWord.Giggle

Technical Details