Class Virus
Platform MSWord

Technical Details

This is a Chinese encrypted Word macro virus. It contains four macros:
Joke, AutoExec, AutoOpen, ToolsMacro.

On opening a document (AutoOpen) the virus creates the temporary “Back”
macro, fills it with its infection routine that reads from document’s
AutoText, executes (infects the NORMAL.DOT) and deletes. The same for
document infection.

Depending on system random counter and day of week the virus displays the
message (but does not format the disk):

Formatting C: . . .
Formatting C: % completed…

The virus then displays the MessageBox:

Format C:Hard disk C: format complete.
You must reboot to take effect !

On pressing “Ok” the virus exits Windows.

Find out the statistics of the threats spreading in your region