Virus.MSWord.Satanic

Class Virus
Platform MSWord
Description

Technical Details


It is an encrypted virus. It contains five macros: AutoOpen, AutoNew,
AutoExec, AutoExit, AutoClose, and infects the system and documents on
creating or closing a document, as well as on AutoExec and AutoExit calls.



On MS Word startup the virus deletes several menu items (macros edition
items). On AutoExit on October 1st the virus formats the hard drive, it
calls DOS COMMAND.COM to perform the command:



echo y|Format c: /u

On creating new document on September 30, the virus displays the message box:



Nightmare Joker 🙂
You’re infected with Satanic

On AutoOpen the virus creates the script file C:FUN.SCR containing
hexadecimal dump of “Claudia” DOS virus. Next it creates and
executes the batch file C:FUN.BAT:



@echo off
debug < Fun.scr > nul
@echo off
nc.com
@echo off
del Fun.scr

Then the virus creates profile section (WIN.INI file) and checks it on next
dropping the DOS virus:



[Control]
Installed=YES

The virus also contains remarked text:



Greetings to Dark Night! Thats good. 🙂