Virus.MSWord.Wnw

Class Virus
Platform MSWord
Description

Technical Details


This macro virus contains seven macros and functions in single module
“WNW”: AutoExec, AutoOpen, FileSaveAs, WNWP, FileTemplates, ToolsMacro,
ViewVBCode. The virus infects the global macros area on opening an infected
document. Other documents get infected on opening or saving with a new name.


On Saturdays and Sundays, the virus displays the warning messages:


On est Samedi, aujourd’hui
Je ne travaillerai pas…
On est Dimanche, aujourd’hui
Je ne travaillerai pas…

Depending on the number of such messages, the virus performs several destructive
operations (see below). The counter of these messages is stored in the
WINWORD8.INI file in the [WNW] section in the Total item.


On the 10th message, the virus displays the MessageBox:


Virus WNW
Vous jouez avec le feu…

and deletes the files: C:WINDOWSBUREAU*.LNK and C:WINDOWSMENU D�MARRER*.*


On the 20th message, the virus displays the MessageBox:


Virus WNW
Je vous avais pr�venu…

and deletes the files:

C:Windows*.ini
C:Autoexec.bat
C:Config.sys
C:Msdos.sys
C:Io.sys

On the 30th message, the virus displays the MessageBox:

Virus WNW
Vous l’aurez voulu!!!!

and formats the C: drive.


On these days, the virus, depending on the system random counter, also either
displays the MessageBox:


Virus WNW
Au revoir…

or draws the text in the header line of Word window:

Je ne veux pas travailler ce weekend, donc, je vais vous en emp�cher…