Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Bleck.A

W97M/Bleck.A is a macro virus operating in the Microsoft Word 97 environments. It attacks active documents and the global template normal.dot. Within the data about the attacked document the name of the author is set to "BLACKROSE" and name of the document to "BLACKCURSE".
After an infected document is opened the virus attacks the global template normal.do and opened documents. After operating in the the global template the virus attacks all documents when they are created, opened, saved and closed.
W97M/Bleck.A has implemented stealth mechanism – in the Word menu it makes inaccessible menu items Tools/Macro, Tools/Options and the Visual Basic editor.
At the beginning of the virus body is the following text:

' W97M/BLACKCURSE
' BY BLACKROSE OF CAMARINES SUR
' BLACKROSE IS ALSO KNOWN AS ULTRAVIOLET,
' SKYFIRE AND BLACKVIRGOCODER

The virus contains activating routine which is started on August 31st. That deletes the contents of an active document if there is one. If no document is opened the virus creates one. It alters the Word heading to the text "Birthday ko " followed by date. In the window with the opened document the following text is displayed:

A CURSE FROM BLACKROSE TO SOMEONE HE HATES

"HIJADIPUTA KANG HAYUP KA!
BURAY MO, SAKA BURAY NI INA MO! HAYUP KA!
SAYANG KA, HAYUP KA!
HAYUP KA TALAGA!"

WORD97/BLACKCURSE
VIRGOBLACKROSE Virus Development
Libmanan Camarines Sur

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.