CAP - infection routine
AutoExec - calls the infection routine
AutoOpen - - // -
FileOpen - - // -
FileSave - - // -
AutoClose - - // -
FileClose - - // -
FileSaveAs - - // -
ToolsMacro - hides all macros ("stealth" routine)
FileTemplates - - // -
The virus not only disables ToolsMacro and FileTemplates menus, but also deletes
the references to them in the File and Tools main menus. The virus also disables
auto-macros. As a result it is not possible to disinfect this virus by using
Word functions -it is not possible to delete macro viruses by creating new or
running existing virus removing macros.
The virus emulates "FileSaveAs" while saving infected documents -and writes
an empty document to disk.
The virus contains the following strings (comments):
C.A.P: Un virus social.. y ahora digital..
"j4cKy Qw3rTy" (jqw3rty@hotmail.com).
Venezuela, Maracay, Dic 1996.
P.D. Que haces gochito ? Nunca seras Simon Bolivar.. Bolsa !
