This virus contains only one macro named ChekFuk in documents and AutoClose in the NORMAL.DOT. The virus infects documents on closing (AutoClose). It infects the global macros area on entering the form field in an infected document - the virus creates a form field in documents and sets the ChekFuk macro as entry-macro for this form field. This method allows the virus do not create auto-macro in documents.
The virus sets the "ChekWarez" password to modify documents' properties, including viewing macros in Tools/Macro menu. On 15th of any month the virus displays the MessageBox:
Do you use ChekMate/ChekWord?
Depending on user's reply the virus then displays one of MessageBoxes:
ChekFuk Virus
Do NOT use ChekWord or ChekMate.
They suck!
ChekFuk Virus
Thank you for NOT using ChekWare.
