| Description:
|
Details
Macro.Word.Eraser
These are very dangerous encrypted China-Word specific macro viruses. "Eraser.a" contains 8 macros: ERASER, AutoOpen, FileNew, FileOpen, ZlockMacro, Games, ToolsMacro. "Eraser.b" contains 7 macros: CKE, AutoOpen, FileNew, FileOpen, ZlockMacro, ToolsMacro, FileTemplates.
Only one macro (FileOpen) contains the infection routine, other macros contain the trigger routines.
Eraser.b
On FileTemplates call, the virus runs the DOS command "echo y|format c:/u". On ToolsMacro call, the virus beeps three times and drops and launches DOS multipartite virus "Hare.7786" and DOS parasitic virus "Europe.421". Depending on the system date the virus appends to the C:AUTOEXEC.BAT file the command:
FORMAT C:/S/U/V:CKE>NUL
The virus displays MessageBoxes in Chinese with the string:
Chungking Express Macro Virus |
