Kaspersky Threats

Class

Platform

Description

Technical Details

This is a Chinese Word macro-virus. It contains 8 macros: Mon, AutoExec,
AutoOpen, FileSave, Organizer, FileSaveAs, ToolsMacro, and FileTemplates.

The virus infects the global macros area (NORMAL.DOT) upon opening an
infected document (AutoOpen), and writes itself to documents that are saved
(FileSave, FileSaveAs).

On Mondays, depending on the system’s random counter, the virus writes a command to the AUTOEXEC.BAT file that formats the disk upon the next rebooting. Upon
entering the File/Templates menu, the virus erases the contents of the current
document, and on Mondays, it also displays the following Message Box:



Samuel says:

Go ahead!  Make my day! ! !

and prints 1000 times the text: “This is DARK MONDAY!!”. It also sets the
password “Monday” to documents, on entering a password the virus compares
it with “Samuel” and displays the MessageBox if password is not:



WRONG password! ! !

You don’t have right to execute this macro command! !    😛

Access Denied! ! !

Find out the statistics of the threats spreading in your region

Class	Virus
Platform	MSWord
Description	Technical Details This is a Chinese Word macro-virus. It contains 8 macros: Mon, AutoExec, AutoOpen, FileSave, Organizer, FileSaveAs, ToolsMacro, and FileTemplates. The virus infects the global macros area (NORMAL.DOT) upon opening an infected document (AutoOpen), and writes itself to documents that are saved (FileSave, FileSaveAs). On Mondays, depending on the system’s random counter, the virus writes a command to the AUTOEXEC.BAT file that formats the disk upon the next rebooting. Upon entering the File/Templates menu, the virus erases the contents of the current document, and on Mondays, it also displays the following Message Box: Samuel says: Go ahead! Make my day! ! ! and prints 1000 times the text: “This is DARK MONDAY!!”. It also sets the password “Monday” to documents, on entering a password the virus compares it with “Samuel” and displays the MessageBox if password is not: WRONG password! ! ! You don’t have right to execute this macro command! ! 😛 Access Denied! ! !
	Find out the statistics of the threats spreading in your region

Virus.MSWord.Monday

Technical Details