Virus.MSWord.Schoo

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted virus. It contains 7 macros:


Documents NORMAL.DOT
GRBack GetRid
AutoOpen AutoOpen2
FileSave FileSave
VerIdent2 VerIdent
FileSaveAs FileSaveAs
BJTradeMark BJTradeMark
ToolsSpelling ToolsSpelling

It infects the global macros area on opening an infected document. It
infects files that are saved with new name.


The virus adds new commands to Word auto-correction:


school -> schoo’
recognize -> reckonize
recognized -> reckonized
assembly -> assemily
CHS -> Crowley High Schoo’

Since 28 of May 1998 the virus displays many MessageBoxes, for example:

Microsoft Word Virus Alert
Warning: The ‘Big Johnson’ Virus has been detected.

On 28 may 1998 it display the MessageBox:

Microsoft Word Virus Alert
Transferring control to virus subroutine:
Virus initializing…
It’s the last day of school!

On all following days it displays the MessageBox:

Microsoft Word Virus Alert
Transferring control to virus subroutine:
Virus initializing…
School’s out!