Class Virus
Platform MSWord

Technical Details

This is an encrypted macro virus. It contains 10 macros:

AutoOpen, FileOpen, FileSaveAs, FilePrint, ToolsMacro, FileTemplates,
FormatStyle, ViewToolbars, ToolsCustomize, VictorWidjaja

When an infected document is opened (AutoOpen), the virus infects the
global macros area. Then it writes itself to documents that are opened
(FileOpen) or saved with a new name (FileSaveAs). The ToolsMacro and
FileTemplates are the stealth macros – they disable the corresponding
Word menus.

On printing a document (FilePrint) the virus erases its contents and
inserts the message:

| Welcome to Victor Widjaja Virus |
|Your computer has been totally infected by ”Victor Widja|
| ja” WordMacro Virus |
| Don’t go anywhere !!! |
| I’ll be back soon to DESTROY your disk data !! |
| Copyright 1996 Virus Research Labs. |

Then the virus prints the message to the status line:

[ Welcome to Victor Widjaja `WordMacro’ Virus – Programmed & Created
by Victor Widjaja the HACKER – Virus Research Labolatory ]

On November 1st the virus prints the same message, then displays the

Victor Widjaja lives in your PC now

The virus then checks the system timer, and if current seconds counter is
equal to 1 or 11 the virus calls the disk erasing function:

Format C: /U /C /S /AUTOTEST > NUL

Find out the statistics of the threats spreading in your region