This is a class module virus for Word 97 documents. It is able to replicate in the SR-1 and above releases of Word 97. It will turn off the macro warning feature of Word 97. This virus consists of a single module within the class stream named "ThisDocument". This virus creates a temporary text file which contains the virus code in a file named "C:\sysboot.bin".
This virus has three date activated payloads.
First, if the current day of the month is the 13th, the active document and any document used will be saved with a random 10 digit numeric password. And if the day of the week is Friday, it will display a message box with this text:
"It's Friday 13th! This is my lucky day, I hope it's yours too!"
"Have A Nice Day!"
If the day is not Friday but the date is the 13th, a message box is displayed with this text:
"Your document has been corrupted because of a bug in Word!
Call Microsoft Customer Support, they can help you. When you call,
tell them this Bug-ID Code (don't forget it!): " (followed by actual password used to protect the document)
After January 1, 2000, the system date is immediately reset to 01/01/80.
(Note: The password payload then happens 13 days later.)