Description
This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Indication of Infection
The virus will copy the viral code to the users NORMAL.DOT, but it hasn't proven successful in infecting document files. Future variants might replicate properly and have nearly identical features to this variant. On an infected system the virus hides the TOOLS|MACRO, FILE|TEMPLATES and VIEW|VBCODE functionality. The virus changes
Microsoft Word in the main application title bar to
ULTRAS. When opening a file, the virus searches for the following file group and deletes the files where possible:
C:\Program Files\AntiViral Toolkit Pro\*.*
C:\Program Files\Command Software\F-PROT95\*.*
C:\Program Files\McAfee\VirusScan\*.*
C:\Program Files\Norton AntiVirus\*.*
C:\Program Files\FindVirus\*.*
C:\f-macro\*.*
C:\Tbavw95\*.*
When opening a file on the 1st, a MessageBox like
|
|
You Infected WM97.ACID by ULTRAS
|
is displayed. Then the active document is saved with the password ACID BY ULTRAS and this text is also inserted in the document in 65-Point blue letters.
When opening a file on the 9th, the same MessageBox is displayed. The virus saves the file with the password ULTRASand this text is also inserted in the document in 140-Purple letters.
When opening a file on the 17th, the virus inserts ULTRAS into the document and the virus searches for the following file group and deletes the files where possible:
C:\Autoexec.bat
C:\Config.sys
C:\Command.com
When opening a file on the 25th, the virus inserts ACID BY ULTRAS into the document and the virus searches for the following file group and deletes the files where possible:
C:\Windows\*.ini
C:\Windows\System\*.dll
Methods of Infection
As this is an intended virus, there is no method of infect. It does not infect.