Kaspersky Threats

Class

Platform

Description

Technical Details

This is an encrypted macro virus. It contains 10 macros:



AutoOpen, FileOpen, FileSaveAs, FilePrint, ToolsMacro, FileTemplates,

FormatStyle, ViewToolbars, ToolsCustomize, VictorWidjaja

When an infected document is opened (AutoOpen), the virus infects the
global macros area. Then it writes itself to documents that are opened
(FileOpen) or saved with a new name (FileSaveAs). The ToolsMacro and
FileTemplates are the stealth macros – they disable the corresponding
Word menus.

On printing a document (FilePrint) the virus erases its contents and
inserts the message:



+————————————————————+

|             Welcome to Victor Widjaja Virus                |

|Your computer has been totally infected by    ”Victor Widja|

|                ja” WordMacro Virus                        |

|                Don’t go anywhere !!!                       |

|        I’ll be back soon to DESTROY your disk data !!      |

|              Copyright  1996 Virus Research Labs.          |

+————————————————————+

Then the virus prints the message to the status line:



[ Welcome to Victor Widjaja `WordMacro’ Virus – Programmed & Created

by Victor Widjaja the HACKER – Virus Research Labolatory ]

On November 1st the virus prints the same message, then displays the
MessageBox:



Attention

Victor Widjaja lives in your PC now

The virus then checks the system timer, and if current seconds counter is
equal to 1 or 11 the virus calls the disk erasing function:



Format C: /U /C /S /AUTOTEST > NUL

Class	Virus
Platform	MSWord
Description	Technical Details This is an encrypted macro virus. It contains 10 macros: AutoOpen, FileOpen, FileSaveAs, FilePrint, ToolsMacro, FileTemplates, FormatStyle, ViewToolbars, ToolsCustomize, VictorWidjaja When an infected document is opened (AutoOpen), the virus infects the global macros area. Then it writes itself to documents that are opened (FileOpen) or saved with a new name (FileSaveAs). The ToolsMacro and FileTemplates are the stealth macros – they disable the corresponding Word menus. On printing a document (FilePrint) the virus erases its contents and inserts the message: +————————————————————+ \| Welcome to Victor Widjaja Virus \| \|Your computer has been totally infected by ”Victor Widja\| \| ja” WordMacro Virus \| \| Don’t go anywhere !!! \| \| I’ll be back soon to DESTROY your disk data !! \| \| Copyright 1996 Virus Research Labs. \| +————————————————————+ Then the virus prints the message to the status line: [ Welcome to Victor Widjaja `WordMacro’ Virus – Programmed & Created by Victor Widjaja the HACKER – Virus Research Labolatory ] On November 1st the virus prints the same message, then displays the MessageBox: Attention Victor Widjaja lives in your PC now The virus then checks the system timer, and if current seconds counter is equal to 1 or 11 the virus calls the disk erasing function: Format C: /U /C /S /AUTOTEST > NUL

Virus.MSWord.Jaja

Technical Details