Kaspersky Threats

Class

Platform

Description

Technical Details

This is an encrypted virus. It contains 7 macros:



Documents      NORMAL.DOT

GRBack         GetRid

AutoOpen       AutoOpen2

FileSave       FileSave

VerIdent2      VerIdent

FileSaveAs     FileSaveAs

BJTradeMark    BJTradeMark

ToolsSpelling  ToolsSpelling

It infects the global macros area on opening an infected document. It
infects files that are saved with new name.

The virus adds new commands to Word auto-correction:



school     ->  schoo’

recognize  ->  reckonize

recognized ->  reckonized

assembly   ->  assemily

CHS        ->  Crowley High Schoo’

Since 28 of May 1998 the virus displays many MessageBoxes, for example:



Microsoft Word Virus Alert

Warning: The ‘Big Johnson’ Virus has been detected.

On 28 may 1998 it display the MessageBox:



Microsoft Word Virus Alert

Transferring control to virus subroutine:

Virus initializing…

It’s the last day of school!

On all following days it displays the MessageBox:



Microsoft Word Virus Alert

Transferring control to virus subroutine:

Virus initializing…

School’s out!

Class	Virus
Platform	MSWord
Description	Technical Details This is an encrypted virus. It contains 7 macros: Documents NORMAL.DOT GRBack GetRid AutoOpen AutoOpen2 FileSave FileSave VerIdent2 VerIdent FileSaveAs FileSaveAs BJTradeMark BJTradeMark ToolsSpelling ToolsSpelling It infects the global macros area on opening an infected document. It infects files that are saved with new name. The virus adds new commands to Word auto-correction: school -> schoo’ recognize -> reckonize recognized -> reckonized assembly -> assemily CHS -> Crowley High Schoo’ Since 28 of May 1998 the virus displays many MessageBoxes, for example: Microsoft Word Virus Alert Warning: The ‘Big Johnson’ Virus has been detected. On 28 may 1998 it display the MessageBox: Microsoft Word Virus Alert Transferring control to virus subroutine: Virus initializing… It’s the last day of school! On all following days it displays the MessageBox: Microsoft Word Virus Alert Transferring control to virus subroutine: Virus initializing… School’s out!

Virus.MSWord.Schoo

Technical Details