Virus Characteristics
This is a cross application virus for Word documents in Microsoft Word 97 and 2000, workbooks in Microsoft Excel 97 and 2000. It is able to replicate under the SR-1 release of Office 97. It will turn off the macro warning feature of both Word/Excel 97. This virus consists of a module called "ThisDocument" in Word97 and "ThisWorkbook" in Excel97.
In Word, this virus stays resident in the normal.dot file; in Excel, it creates a Workbook called "Book1." in the XLStart directory. Due to the extension-less file in the XLStart folder, AVERT recommends scanning ALL files to detect and remove.
This virus has payloads which are date activated.
In Word97 when a document is closed:
On the 1st of any month, there is a one-in-ten chance of changing all occurrences of "I" to "1".
On the 5th of any month, there is a one-in-ten chance of deleting all occurrences of the word "not".
On the 10th of any month, there is a one-in-fifteen chance of displaying a modified "Office Assistant Balloon" with the heading "Cross.BadSeed v0.41" and the following text:
"Programmer: 1nternal"
"Class Infection: VicodenES"
"ActiveX Concept: 1nternal"
"Book1. Concept: VicodenES"
"1nternal also wishes to thank all contributors and supporters which have made Cross.BadSeed possible."
On the 15th of any month, there is a one-in-ten chance of opening the author's web page.
On the 20th of any month, there is a one-in-five chance of displaying "Cross.BadSeed v0.41/1nternal" on the status bar.
In Excel97 they payloads are more severe - when a workbook is closed:
On the 1st of any month, there is a one-in-ten chance of adding the comment "Cross.BadSeed v0.41" to ten randomly selected cells.
On the 10th of any month, there is a one-in-three chance of performing up to 30 random cell swapping in up to 5 different columns.
On the 10th of any month, it will change the author to "1nternal" for the workbook.
On the 20th of any month, there is a one-in-five chance of displaying "Cross.BadSeed v0.41/1nternal" on the status bar.