Virus.MSWord.Naen

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted virus that contains four macros: OemLogo, FileTemplates,
AutoOpen (MeoClose in NORMAL.DOT), OemClose (AutoClose in NORMAL.DOT).


The virus infects the global area on AutoOpen and writes itself to the
documents on AutoClose. On entering File/Templates menu the virus displays
the MessageBox:


Microsoft Windoze
Windoze Frotection Error

The virus creates the C:WINDOWSSYSTEMOEMINFO.INI file and writes the
text to there:

[general]
Manufacturer=NAENBGOURSG
Model=209711 – SO.HT.AI.KS

The virus then creates the C:WINDOWSSYSTEMOEML.NIK file and writes to
there a hexadecimal dump of OEMLOGO.BMP, then creates the
C:WINDOWSSYSTEMOEMZ.BAT file and writes to there commands that convert
this hexadecimal dump to BMP file:

@echo off
debug < oeml.nik > nul
del oeml.nik
del oemz.bat

The resulting BMP file contains a logo with text:

CREATED BY NAENBGOURSG


The virus also contains commented text strings:


by NAENBGOURSG
SO.HT.AI.KS
231076-GREECE
VRD 19-4-1997
——————————
+ · ÷ x
x x
·
·
——————————–
Latin word -virus- means poison and is a derivative
of two Sanskritic roots –> -vishas->(poison)
and -ishus->(arrow).
NAENBGOURSG – SO.HT.AI.KS
M.SC. in MacroViral Science
———————————