Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Chack.B

W97M/Chack.B is a macro virus operating in the Microsoft Word 97 environment. It attacks active documents and the global template normal.dot. It consists of two modules - CyberHack and CyberForm. The first one contains the virus code and in the second one is its activating routine.
After the infected document is opened the virus turns off the Word anti-virus protection and disables displaying of warning at writing into the global template and of all other warnings. It makes the Visual Basic editor inaccessible, deletes the item Tools/Macro in the menu and prohibits the keyboard shortcuts ALF+F11 and ALT+F8. Then it attacks the global template normal.dot and opened documents. After the global template was infected the virus attacks all documents when they are created, opened, saved and closed. After attacking documents it renews displaying the warning windows.
On Fridays it runs the macro CyberForm upon closing a document. The virus presents itself in the same way at an attempt to open the Word item Help/About Microsoft Word. That macro displays a dialogue with a picture.
At the beginning of the virus body is the following text:

' Macros By WinK'S Hacker
' Picture By Casper Satan

' Lebih baik mencoba dari pada tidak tahu sama sekali ...
' Mohon ma'af bila telah mengganggu Anda.
' Microsoft memang gila ! Nambahin fasilitas pemrogramannya
' keterlaluan untuk suatu word prosesor.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.