Name: Macro.Word.Jaj Category: Viruses Description: Details Macro.Word.Jaja This is an encrypted macro virus. It contains 10 macros: AutoOpen, FileOpen, FileSaveAs, FilePrint, ToolsMacro, FileTemplates, FormatStyle, ViewToolbars, ToolsCustomize, VictorWidjaja When an infected document is opened (AutoOpen), the virus infects the global macros area. Then it writes itself to documents that are opened (FileOpen) or saved with a new name (FileSaveAs). The ToolsMacro and FileTemplates are the stealth macros - they disable the corresponding Word menus. On printing a document (FilePrint) the virus erases its contents and inserts the message: +------------------------------------------------------------+ | Welcome to Victor Widjaja Virus | |Your computer has been totally infected by ''Victor Widja| | ja'' WordMacro Virus | | Don't go anywhere !!! | | I'll be back soon to DESTROY your disk data !! | | Copyright 1996 Virus Research Labs. | +------------------------------------------------------------+ Then the virus prints the message to the status line: [ Welcome to Victor Widjaja `WordMacro' Virus - Programmed & Created by Victor Widjaja the HACKER - Virus Research Labolatory ] On November 1st the virus prints the same message, then displays the MessageBox: Attention Victor Widjaja lives in your PC now The virus then checks the system timer, and if current seconds counter is equal to 1 or 11 the virus calls the disk erasing function: Format C: /U /C /S /AUTOTEST > NUL