This virus contains one procedure “Document_Close” in one module. It
replicates upon document closing. While infecting, the virus turns off the
Word anti-virus protection (the VirusProtection option).
This virus has a generation counter, and runs its payload routine when
the generation counter exceeds 69. This routine is activated upon document closing,
and displays an assistant balloon with the following message:
Isn’t life just a bitch
Choose an option.
with three buttons:
Loose all your data.
Loose most of your data.
Loose just enough data to really fuck you off
After choosing any of them, the virus inserts to the beginning of the document
the following text:
Don’t Worry About a Thing !!! I wouldn’t fuck up your data !!!
This text is formatted with in green with a font size of 24.
This virus has stealth functions: it disables the “Tools/Macro” menu and
viewing Visual Basic code. It also has an expanded payload routine. Before
displaying the assistance balloon, it inserts into a document 36 shapes, “smiley
face”, of different colors.