Miguel
beagle
Ellen haavoittuvuus
Tuolta tais löytyä yksi. :nope:OoPee sanoi:
This is a virus for Word 97 documents. It is able to replicate under the SR-1 release of Word 97. It will turn off the macro warning feature of Word 97. This virus consists of a module called "Jany_2000". This virus will implement mIRC and Pirch to send infected documents when logging into channels after connecting to the Internet via modified script files. This virus also has message boxes which are displayed on specific dates. This virus uses exports the Visual Basic source code to a temp file named C:\JANY2000.DLL for use later during infection routine, where the code is imported to the document or global template.
This virus hooks the system event of opening Word97 by the subroutine "autoopen" thereby running its code. Other system events hooked are "autoclose" and "autonew". Attempts to use menu items of the same name within Word97 will run the macro code routine. Attempts to view the macro code will give a message box with the text "No code too see!" (typo).
Comments within the virus which are never shown:
'V_Name = [JANY2000]
'Author = [Del_Armg0]
'Date = [14nov99]
'Type = [W97MacroVirus/Mirc_Pirch_Worm/NoDestructor!/AndAlwaysForAGirl]
'GreetZ = [Jany, Secret aka Stram !
'Disclaim=[JE L'AIME TOUTE ENTIERE... SIMPLEMENT]
After infecting the global template, the current and active document is saved as different file names in the C:\WINDOWS path as "Jany_is_cute.doc", "Jany_is_Sweet.doc", "Jany2000.doc" and "PASSWORDS.doc".
Script files are also written to the local machine as "c:\mirc\script.ini", "c:\pirch32\events.ini" and "c:\pirch98\events.ini".
When signing onto mIRC channel(s), the two files "C:\WINDOWS\Jany_is_cute.doc" and "C:\WINDOWS\Jany_is_Sweet.doc" are sent to all users on the channel with the message "Jany2000 HI!!! Une Jany Virtuelle, c deja ca!!!
When connecting to Pirch channel(s), the two files "C:\WINDOWS\Jany2000.doc" and "C:\WINDOWS\PASSWORDS.DOC" are sent to all users with the message "A Del_Armg0 Ripped! Script 4 Jany".
Below are listings of the different message boxes displayed. The warning on the 31st is a hoax however and no damage will occur to the computer.
On 1st of any month, this message is displayed:
"Lorsque tout me ravit, J'ignore"
"Si quelque chose me seduit."
"Elle eblouit comme l'Aurore"
"Et console comme la Nuit;"
On 2nd of any month, this message is displayed:
"Et l'harmonie est trop exquise,"
"Qui gouverne tout son beau corps,"
"Pour que l'impuissante analyse"
"En note les nombreux accords."
On 31st of the month, this message is displayed:
"U're going now to be Destroyed ! Sorry, but if u ShutDown, u won't restart, believe me ! ; )" "But U can Do one Thing... if u're able to save 25 .doc in 1 minutes, i leave u alone... almost... C u
On Feb 14, this message is displayed: "Pire que tout l'Amour-Propre et la Fierte,... Mais l'Amour reste Pur, Sage & Eternel... La Vie n'en est pas moins dure... 1000BaiserS a toi... & Happy St Valentin à vous toutes que j'Aime tant", "Fa_luv_U"
On May 15, this message is displayed:
"Et l'harmonie est trop exquise Qui gouverne tout son beau corps, Pour que l'impuissante analyse En note les nombreux accords."
On Nov 8, this message is displayed:
"Lorsque tout me ravit, J'ignore"
"Si quelque chose me seduit."
"Elle eblouit comme l'Aurore"
"Et console comme la Nuit;"
