18-20, MSIDA ROAD,
GZIRA. GZR 1401.
MALTA.
TELEPHONE: (0356) 21 31 32 83 or 21 32 08 45
FAX: (0356) 21 33 80 87
E-MAIL CONTACT
sales@fabian.com.mt
Word 97 Macro-Virus Triplets:Macro.Word97.Opey.X., Macro.Word97.Coccopy.A, Macro.Word97.Myna.AL
Anti-virus software developers announce the detection of a trio of Word 97 macro-viruses “in the wild.”
The first of the troika is Macro.Word97.Opey.X.
Should the month be later than July, the virus makes the following alterations to the document's user details:
User name = "Crazy Man"
User address = "LBTMM B'99 PHILIPPINES"
User initials = "Crazy"
The virus also alters the file summary information to:
Author = "Crazy Man"
Title = "Crazy"
Manager = "MMA"
Company = "Crazy Man Company"
Comments = "HELLO I am the Crazy
Man From the Crazy World of
Computer. Don't you worry I'm not as
crazy than you think...".
Should a user try accessing the Tools/Macro menu, the virus displays a message box containing the phrase, "AHA! You want to know about my Macro Code.. Kill Me FIRST..".
At 3 p.m., before exiting Microsoft Word, the virus displays another
message box containing the text, "It's 3:00 P.M., Please Pray The salvation
of your Life, cause you don't know it's is the time for you to die..."
If the time is 12:05 p.m., before exiting Microsoft Word, the virus displays another message, "It's 12:00 it's time for Lunch..."
The second in the trio is Macro.Word97.Coccopy.A, which creates an infected file called saver.dll in the directory that Microsoft Word has been run from, and then creates a subdirectory under Microsoft’s Word directory called Doc-Copy (for example, C:\WORD\Doc_Copy), into which it places copies of the infected files.
Number three in the trio is the latest offspring from the Myna macro-virus family that has been christened Macro.Word97.Myna.AL, which contains no intentionally malicious payload other than replication. The virus contains the MYNAMEISVIRUS, which is used as a flag to check to see whether it has already infected a file.
This Myna variant has also interacted with a member of the Macro.Word97.Marker
virus family so that whenever a document is closed, there is a 33.3% chance
of a File Summary box appearing on the screen with the author's name set
to Ethan Frome.
We thank you ALL for your kind votes which made this site FIRST in two categories.
A 10 vote = Very Good
A 1 vote = Waste of cyber Space !
ALL those sending emails of thanks are kindly requested to indicate whether these are for publication.
IMPORTANT NOTICE:
ALL those who are receiving this advise
and in the "name" field they find 'FAILED' and a 6 or 8 digit figure
after it, should be advised that at least once, emails to that address
have been received back by us. As the list of subscribers now exceeds 100,000, and since this
is a free service, we kindly urge you to become a registered
subscriber to this service and ensure delivery by subscribing under
a reliable email address. WE REGRET THAT AS AFTER THIS ISSUE,
ALL ADDRESSES THAT ARE NOT DELIVERABLE WILL BE REMOVED FROM THE LIST.
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty
of any kind. In no event shall we be liable for any damages whatsoever
including direct, indirect, incidental, consequential, loss of business profits
or special damages.
PLEASE ADVISE ALL YOUR FRIENDS ON YOUR LIST
PLEASE ALSO NOTE THE FOLLOWING:
1) You are currently SUBSCRIBED to our mailing list
2) If you are receiving more than one copy of this warning please click here
3) If you DO NOT wish to receive anymore of these alerts, please click here
4) YOUR friends are also welcome to be on the VIRUS ALERT but an email has to be
sent to the Webmaster by themselves so that a record of all requests can be kept in case
somebody cries "SPAM" ! Simply click here
and send the email as it appears.
5)THIS IS A FREE SERVICE RUN IN THE PUBLIC INTEREST BY
6) ALSO PLEASE BE ADVISED THAT YOUR EMAIL WILL
NEVER BE SOLD, EXCHANGED OR IN ANYWAY WHATSOEVER DISCLOSED TO ANYBODY ELSE.
******
Fabian Brincat
Webmaster
Fabian Enterprises Ltd.
SEE PREVIOUS VIRUS ALERT
RETURN TO VIRUS ALERT MAIN INDEX
©ALL MATERIAL IS PROTECTED BY COPYRIGHT LAWS AND MAY NOT BE REPRODUCED IN ANY FORM WHATSOEVER WITHOUT THE PRIOR WRITTEN CONSENT OF THE WEBMASTER.
190301/210301/071004
