Virus.MSWord.Williamto

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted Word macro virus. It contains 16 macros: Halim,
FileNew, AutoOpen, FileOpen, FileSave, FileClose, FilePrint, HelpAbout,
Williamto, FileSaveAs, ToolsMacro, FormatStyle, JustifyPara, ViewToolBars,
FileTemplates, ToolsCustomize.


The virus infects the global macros area (NORMAL.DOT) on opening an
infected document (AutoOpen) and writes itself to documents that are
opened, saved or saved with new name (FileOpen, FileSave, FileSaveAs).


This is the stealth virus: it draws its own dialog on entering Tools/Macro
menu, on pressing any button the virus displays the MessageBox:


WordBasic Err = 7
Not enough memory

After opening a file the virus displays the message:

Williamto Virus
Williamto WordBasic Virus
Programmed by Williamto Halim
Virus Research Laboratory
Dedicated to Angelia Hadeli

On error while saving files the virus displays:

Attention!!!
Williamto Halim always lives in your computer

On closing files it displays:

File Close
Please close it later! Let’s have fun!

On July 9 it displays:

Nice Day
Happy Birthday Amgelia Hadeli by Williamto Halim

The virus also replaces the “About Microsoft Word” with:

About Microsoft Word
Williamto WordBasic Virus
Programmed by Williamto Halim
Virus Research Laboratory
Dedicated to Angelia Hadeli

On printing documents the virus erases original text and prints its text:

Welcome to Williamto Word Macro Virus
I’m sorry about this but your computer has been infected by
Williamto Word Macro Virus
Please beware about this!!!
This Virus will destroy your data in your disk!!!
Copyright 1997 Virus Research Labs (Jakarta/Indonesia)

While printing the virus outputs to the status line the text:

[ Welcome to Williamto Word Macro Virus – Programmed & Written by
Williamto Halim the Hackers – Virus Research Laboratory ]

On November 11th the virus formats the hard drive and displays the
MessageBox:

Attention!!!
I will format your hard disk now, ha-ha-ha!