| Detection added |
May 31 2006 |
| Update released |
Jun 01 2006 17:40 GMT |
| Description added |
Jun 05 2006 |
| Behavior |
Virus |
Stardust is a family of macro viruses written in StarBasic, a Basic-like programming
language used by the StarOffice/ OpenOffice suite.
Due to a couple of severe programming errors, the virus' intended functionalities
do not work correctly, and they are unable to replicate.
Variant-specific notes
All variants contain the following comment:
*******************************
******* OOo.Stardust *********
*** (c)by Necronomikon[DCA] ***
*******************************
Some of the variants will attempt to download a picture of Silvia Saint -
a
popular adult film star - from a website hosted by tripod.com. The website was
removed on June 1st, 2006. The viruses will also insert the following string
into the active document:
***Stardust***(c)by Necronomikon[DCA]
Technical details
Due to a couple of programming errors, none of the variants known at the time
of writing of this description actually work. Additionally, some of the variants
have the call to the replication subroutine disabled while one version lacks
it completely.
The subroutine which is supposed to take care of the replication part is
checking for the presence of a global module called "stardust" and if it is
not found, it attempts - at least in theory - to copy itself there. Furthermore,
there is no code in the virus to recursively infect clean documents from the
global module.
