Virus.MSWord.Louvado

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted macro virus. It contains only one macro in documents:
AutoOpen. While infecting NORMAL.DOT it copies this macro to there with
thirteen names: AutoClose, AutoNew, AutoOpen, AutoExit, FileOpen, FileNew,
FileSaveAs, FileClose, FileSave, FileSaveAll, Alevirus, Delta,
SaoCaetanoDoSul.


It writes itself to the global macros area on opening an infected document
(AutoOpen). It infects documents on calling any of macros that are listed
above (i.e. on document creating, opening, closing, saving e.t.c).


The virus writes to the Subject field in the FileSummaryInfo the string:


Alevirus and Delta first virii Macro 1997!”

On 13, 14, 19, 24 on any month it erases all files in the root directory on
the C: drive and all files in directories:

C:WINDOWSC:WINDOWSSYSTEMC:WINDOWSCOMMANDC:MSOFFICEC:MSOFFICEWINWORDC:MSOFFICEEXCELC:WINWORDC:DOSC:RAC:PCBC:PCBMAINC:PCBDL01

The virus then displays the MessageBoxes:

Voce GAY??????
Alevirus and Delta SCS first Macro Virii Brasil!!!
Ligue para essa vaca Viviane ela faz programa hehe 215-1966
Tron manda seu disco para finalizar o maudoso MASTER CONTROL
ViVa a Improdutividade e a cerveja mais vendida ANTARTICA!!
Homenagem ao meu filho Henrique Parabens! Nene!
Homenagem a Fernada Regina Tessarine Descarnada em 20.09.96
Puxa vida Fe ta dificil viver se voce!!!Esteja com Deus!!
Deus Seja Louvado!!! Alevirus :)))