| Description:
|
Details
Macro.Word97.Wnw
This macro virus contains seven macros and functions in single module "WNW": AutoExec, AutoOpen, FileSaveAs, WNWP, FileTemplates, ToolsMacro, ViewVBCode. The virus infects the global macros area on opening an infected document. Other documents get infected on opening or saving with a new name.
On Saturdays and Sundays, the virus displays the warning messages:
On est Samedi, aujourd'hui
Je ne travaillerai pasall
On est Dimanche, aujourd'hui
Je ne travaillerai pas...
Depending on the number of such messages, the virus performs several destructive operations (see below). The counter of these messages is stored in the WINWORD8.INI file in the [WNW] section in the Total item.
On the 10th message, the virus displays the MessageBox:
Virus WNW
Vous jouez avec le feu...
and deletes the files: C:WINDOWSBUREAU*.LNK and C:WINDOWSMENU DãMARRER*.*
On the 20th message, the virus displays the MessageBox:
Virus WNW
Je vous avais prÊvenu...
and deletes the files:
C:Windows*.ini
C:Autoexec.bat
C:Config.sys
C:Msdos.sys
C:Io.sys
On the 30th message, the virus displays the MessageBox:
Virus WNW
Vous l'aurez voulu!!!!
and formats the C: drive.
On these days, the virus, depending on the system random counter, also either displays the MessageBox:
Virus WNW
Au revoir...
or draws the text in the header line of Word window:
Je ne veux pas travailler ce weekend, donc, je vais vous en empËcher... |
