For Home

Virus Profile: W97M/Courage.a

Threat Search
Print
   
Virus Profile information details
Risk Assessment: Home Low | Corporate Low
Date Discovered: 3/20/2000
Date Added: 1/25/2001
Origin: China
Length: N/A
Type: Virus
Subtype: Macro
DAT Required: 4072
Removal Instructions
   
 
 
   

Description

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Indication of Infection

This virus checks if the day is 15, if so, it will display a Chinese message box in the form of a question which translates to the following:

Today is 15th March, My Virus has occurred,
do you want format your hard disk?
[Yes] [No]

If response is No, message box shows a message which translates to

I am very sorry, the computer has been infected with virus."

If response is Yes, message box shows a message which translates to

I admired your courage, Please go on.

The hard drive is not formatted if either response is selected.

Methods of Infection

This virus hooks the Word event handler of opening or creating documents in order to run its code.

Aliases

Macro.Word97.Courage (AVP), W97M_COURAGE.A (Trend)
   

Virus Characteristics

This is a macro virus for Word97 documents and templates. This virus contains message boxes displayed in Chinese characters on applicable systems. Word environments which are not in Chinese will still display however the message box is not comprehensible.

This virus consists of three macro modules "autoopen", "autoexec" and "autonew". This virus checks if the day is 15, if so, it will display a Chinese message box in the form of a question.

Variants

Variants information
Virus Name Type Subtype Differences
W97M/Courage.B Virus Macro Contains a timer to run macro code every five minutes and thirty seconds. Does not display message box on 15th.
   

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

But in some particular cases, the following steps need to be taken.

Please go to the Microsoft Recovery Console and restore a clean MBR.

On Windows XP:

  • Insert the Windows XP CD into the CD-ROM drive and restart the computer.
  • When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
  • Select the Windows installation that is compromised and provide the administrator password.
  • Issue 'fixmbr' command to restore the Master Boot Record
  • Follow onscreen instructions.
  • Reset and remove the CD from CD-ROM drive.


On Windows Vista and 7:

  • Insert the Windows CD into the CD-ROM drive and restart the computer.
  • Click on "Repair Your Computer".
  • When the System Recovery Options dialog comes up, choose the Command Prompt.
  • Issue 'bootrec /fixmbr' command to restore the Master Boot Record.
  • Follow onscreen instructions.
  • Reset and remove the CD from CD-ROM drive.