VIRUS ALERT
ShareTheFun
ShareTheFun is incripted into an MS-Word Macro named Macro.Word.ShareFun
This virus manifests itself by sending infected documents via MicrosoftMail
The following material is copyrighted
February 26, 1997
Macro.Word.ShareFun
- Technical record and specs:
This encrypted Word macro virus contains nine macros:
| AutoExec | does nothing |
| autoOpen | infects current document or global macros area |
| FileClose | infects current document or global macros area |
| FileExit | infects current document or global macros area |
| FileSave | infects current document or global macros area |
| FileOpen | infects current document or global macros area |
| FileTemplates | infects current document or global macros area |
| ToolsMacro | infects current document or global macros area
disables Tools/Macro menu (stealth) |
| ShareTheFun | trigger routine |
The virus infects the system and documents on opening, closing and accessing the Tools/Macro menu.
It manifests itself in very unusual way - it sends infected documents via MicrosoftMail. (if it is installed.)
On opening a document or template (AutoOpen) the virus with probability of 1to4 calls the ShareTheFun macro.
This macro saves the current (already infected!) document to the C:\DOC1.DOC file, runs Microsoft Mail, gets three random selected addresses
from addresses list and sends them the infected C:\DOC1.DOC file.
The subject line of the email message will read:
You have GOT to read this!
If there is no Microsoft Mail installed, the virus shuts down Windows.
Copyright Eugene KASPERSKY © 1997 ( eugene@avp.ru )
Contact : Editions Gerard MANNIG ( avpcontact@eeb.fr ) (English/French/Spanish fluently handled )
- More information:
Macro virus transmitted by Microsoft Mail
" ... The Good Times email virus may have been a hoax, but this week the first real Word macro virus, spreading via Microsoft Mail has
been uncovered"
The virus, ShareFun.A, infects documents in Versions 6 & 7 of Microsoft Word. The latest version, Word 97, which is in the Office 97 suite, can
automatically block the virus from activating.
Once activated, there is a 1-in-4 chance the virus will launch MS Mail and attach infected documents to messages sent to three people. The virus
selects the three recipients randomly from the user's address book.
The subject line of the infected email will read, "You have GOT to read this!" echoing previous hoax viruses such as Good Times.
The Good Times virus hoax, however, suggested that a user could be infected with the virus simply by reading the email. ShareFun.A requires a
user to actually open an infected document.
If a user opens the infected mail attachment with Word, his or her Word template will become infected and the macro virus will continue to replicate.
HOME
Back to the MAIN PAGE
Back to the VIRUS ALERT INDEX PAGE
Read the DISCLAIMER
Site development and administration by PCS
