Virus Databases
Virus Links
Virus Research
Security



Macro Virus: WordMacro/Bandung

Name: WordMacro/Bandung
Type: Word Macro Virus
Description:

This virus consists of six macros:

  • AutoExec
  • AutoOpen
  • FileSave
  • FileSaveAs
  • ToolsCustomize
  • ToolsMacro

If an infected document is opened (or if Word is started from an infected NORMAL.DOT) on the 20th or later of any month after 11:00, the virus deletes all files in all subdirectories of drive C:, except the subdirectories named \WINDOWS, WINWORD, or WINWORD6. While this is happening, the virus displays the message "Reading menu...Please wait!" on the status line. After the deletion has completed, the virus creates the file C:\PESAN.TXT and writes a message in the file.

If the user selects Tools/Customize or Tools/Macro and the current date is after March 3, 1996, the virus displays a message box saying "Fail on step 29296" (with the title "Err@#*(c)" and the STOP symbol) and then replaces all occurences of the character 'a' in the document with "#@" and the document is saved to the disk. The actual function (Tools/Customize or Tools/Macro) is not performed.

Based on information provided by Vesselin Bontchev, Frisk Software International.