| Description:
|
Details
Macro.Word.Beeper.a
These are encrypted Word macro viruses. They contain six original macros in NORMAL.DOT and infected documents:
"Beeper.a": AutoExec, AutoClose, AutoOpen, AutoNew , TheTime , Kill
"Beeper.b": AutoOpen, TFGAMV, AutoExec, AutoNew, AutoClose, Joke
While infecting global macros area (NORMAL.DOT) "Beeper.b" also creates two addition macros with random selected names. These macros contain copies of the TFGAMV and Joke macros.
The viruses infect the global macros area while infecting an opening document. They write themselves to documents while opening existing or creating a new document (AutoOpen, AutoNew).
Beeper.a
It maximizes Word windows and inserts into the current document the text:
You are infected with
The Time
A virus from Cool Zero
The virus does not executes the Kill and TheTime macros, i.e. they may be activated only by user's request (by File/Templates or Tools/Macro menus). When activated, the TheTime macro checks the system time and at 15:59 beeps and displays the MessageBoxes:
Hi I'm the Time virus
I don't like Your COMMAND.COM and AUTOEXEC.BAT
Play with me !! :-)
You have 1 Minute time to find me
Find me, I do nothing
Find me not
SAY BYE TO YOUR COMMAND.COM AND AUTOEXEC.BAT
The Kill macro at 16:00 deletes the files C:COMMAND.COM and C:AUTOEXEC.BAT.
Beeper.b
This virus prints documents on opening them (AutoOpen). At 17:00 it tries (but fails) to create and execute the SMILEY.COM file. This file contains an "intended" DOS virus. |
