Virus.MSWord.Jaja

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted macro virus. It contains 10 macros:


AutoOpen, FileOpen, FileSaveAs, FilePrint, ToolsMacro, FileTemplates,
FormatStyle, ViewToolbars, ToolsCustomize, VictorWidjaja

When an infected document is opened (AutoOpen), the virus infects the
global macros area. Then it writes itself to documents that are opened
(FileOpen) or saved with a new name (FileSaveAs). The ToolsMacro and
FileTemplates are the stealth macros – they disable the corresponding
Word menus.


On printing a document (FilePrint) the virus erases its contents and
inserts the message:


+————————————————————+
| Welcome to Victor Widjaja Virus |
|Your computer has been totally infected by ”Victor Widja|
| ja” WordMacro Virus |
| Don’t go anywhere !!! |
| I’ll be back soon to DESTROY your disk data !! |
| Copyright 1996 Virus Research Labs. |
+————————————————————+

Then the virus prints the message to the status line:

[ Welcome to Victor Widjaja `WordMacro’ Virus – Programmed & Created
by Victor Widjaja the HACKER – Virus Research Labolatory ]

On November 1st the virus prints the same message, then displays the
MessageBox:

Attention
Victor Widjaja lives in your PC now

The virus then checks the system timer, and if current seconds counter is
equal to 1 or 11 the virus calls the disk erasing function:

Format C: /U /C /S /AUTOTEST > NUL