Macro Virus Table - Defense Technical Information Center

MACRO
Macro Viruses
Name: WM.Outlaw.B
Aliases: WM.Outlaw.B, Outlaw.B Type: Macro.
Disk Location: Word template files. Features: No damage, only replicates.
Damage: No damage, only Size: Adds Macros to Word See Also: WM.Outlaw.A
replicates.
document/template files
Notes: This is a Word macro virus
It does not spread on the Macintosh.
This may not be a new virus but WM.Outlaw.A with different macro names. Outlaw is known to
change the names of its macros.
See WM.Outlaw.A for information.
Macros installed:
O7920
O8493
O9259
Name: WM.PayCheck
Aliases: WM.PayCheck, Bukit Type: Macro.
Disk Location: Word template files. Features: No damage, only replicates.
Damage: No damage, only Size: Add macros to Word See Also:
replicates.
document/templates files
Notes: WM.PayCheck is an encrypted macro virus. It contains seven macros: AutoExec,
AutoOpen, FileSave, FileSaveAs, ToolsMacro, ShellOpen, FileOpen.
WM.PayCheck actives on the 25th of any month. At this time it displays this dialog box:
Selamat
Sekarang adalah tanggal 25, sudahkah anda mengambil gaji?
He..he..Selamat. Kalau bisa, lebih keras lagi kerjanya.
Bravo Bukit Asam !!!
Opening the File/SaveAs menu might display this dialog box:
Non Critical Error
Internal error was occured in module UNIDRV.DLL
Your application may not be work normally.
Please contact Microsoft Product Support.
Opening the Tools/Macro menu might display this dialog box:
Critical Error
Internal error was occured in module UNIDRV.DLL
Please contact Microsoft Product Support.
44 CIAC Computer Virus Information Update May 21, 1998