This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Indication of Infection
At random, the virus will display the following message:
"SkRiPsI is SuCK"
If the month is January, February, March, April, May, June, or December then the content of the open word document(s) is erased.
On November 5 the following message is displayed:
"Happynes to all of you"
When the Help|About menu is selected the following message is displayed:
Welcome to my world
Please enjoy your time
BEFORE YOUR DIE"
Choosing the TOOLS|MACRO menu results in this message being displayed:
"This message is displayed
Macro Function is not active
Never use IT"
Clicking OK will result in your CD-ROM drive opening and closing and this message being displayed:
"Did you enjoy your time?
Don't do it again OK!"
Clicking OK again repeats this pattern 15 times (unless a CD is in the drive in which case it will AutoPlay).
Clicking the TOOLS|OPTIONS menu turns the macro virus protection off in Word.
When File|Exit is selected the following actions occur:
The registered owner of the computer is changed to:
This message appears:
"Please Turn-off your computer
Don't Click bellow"
Clicking the OK button results in the deletion of the following files:
This message is then displayed:
"You aren't obey my order
May the God Bless You"
Methods of Infection
Opening an infected document or template will infect the global "Normal.dot" template.
"mIRC" is used as a transport method under certain conditions.
W97M/Fool.bat, W97M/Fool.ini, W97M/Fool.src, W97M/Fool.vbs