Virus.MSWord.Nomvir

Class Virus
Platform MSWord
Description

Technical Details


This is a very dangerous virus. It contains ten macros: AutoExec, AutoNew,
AutoOpen, DateiSpeichern, DateiSpeichernUnter, DateiBeenden,
ExtrasOptionen, DateiDokvorlagen, FuckIt, and DateiDrucken.


Upon AutoNew and AutoExec, it infects the global macros area. Upon
DateiSpeichern and DateiSpeichernUnter (FileSave, FileSaveAs), it infects a
document.


The virus looks for the “Nomvir=” parameter in the “Compatibility” section (WIN.INI
file), and does not perform any action if there is “Nomvir=0x0690690”. The virus also
creates a counter “iCount” in the “intl” section, and increases it when any
document is printed. Depending on the counter, the virus deletes the
C:AUTOEXEC.BAT and C:CONFIG.SYS files. Depending on the system date, the
virus replaces some words in documents with “hell” or appends to the end of
the document the following text:


Fuck Microsoft & Bill Gates

On January 1st, December 25th, on the 23rd of any month, and on Saturday 13th, it
deletes the following files:

C:WINDOWSUSER.DA0
C:WINDOWSSYSTEM.DA0
C:WINDOWSUSER.DAT
C:WINDOWSSYSTEM.DAT

Depending on the system time, the virus sets randomly selected passwords for documents. Upon accessing Tools/Macro and the DateiDokvorlagen menu,
the virus displays the MessageBoxes:

Nicht gen�gend Arbeitsspeicher !
Interner Fehler !