Macro Virus Table - Defense Technical Information Center

MACRO
Macro Viruses
Notes: SAM 4 with the 5/3/97 virus definitions can detect this virus but not by name. It cleans
the virus without problem.
It deletes all existing macros before infection.
Contains the Macros:
AutoClose
AutoOpen
AutoExec
CAP
FileClose
FileOpen
FileSave
FileSaveAs
FileTemplates
ToolsMacro -- this one is not encrypted and is only a procedure shell
The following text is in the macro code.
’C.A.P: Un virus social.. y ahora digital..
’"j4cKy Qw3rTy" (jqw3rty@hotmail.com).
’Venezuela, Maracay, Dic 1996.
’P.D. Que haces gochito ? Nunca seras Simon Bolivar.. Bolsa !
Name: WM.Clock
Aliases: WM.Clock, Clock Type: Macro.
Disk Location: Word template files. Features: No damage, only replicates.
Damage: No damage, only Size: Adds Macros to Word See Also:
replicates.
document/template files
Notes: This is a Word macro virus. When opened, it displays the error: "WordBasic Err=53 File
Not Found".
It does not spread on the Macintosh.
Macros added:
11 macros
Name: WM.Colors.A
Aliases: WM.Colors.A, Colors.A, Colors, Wordmacro
Colors, Rainbow
Type: Macro.
Disk Location: Word template files. Features: Changes system colors.
Damage: Changes system Size: Adds Macros to Word See Also: WM.Colors.B,
colors.
document/template files WM.Colors.C
Notes: This virus uses the macro capability built into Microsoft Word (WordBasic) to add a virus
to a Word document. Since this virus is written in the macro language, it is not platform specific,
but will execute on any platform that runs Word 6 or later.
When you open an infected document, its AutoOpen macro runs and installs an auto execute
macro in your global macro file (normal.dot). Once that is done, the virus code is executed every
20 CIAC Computer Virus Information Update May 21, 1998