It can infect Word environments which have been updated to SR-1 update and above.
    It consists of a single macro module named "virus" and will write its source code to a temporary text file for use as an import to host documents and has a day-of-the-week activated payload It also contains references to Anti-NATO and Anti-Clinton rhetoric as a political message.
    It's subroutines which hook standard Word events such as Autoopen, Autoexec, Autoexit, Filesave and Fileprint.
    When an infected document is opened and it is allowed to run, it will disable macro virus protection settings as well as the menu item Tools|Macro. The source code is written to the file "c:\windows\system\WD_.DRV" for later import use to
host documents.
    It contains a day-of-the-week activated payload. If the day of the week is not Monday, the registry is modified with a key that the virus uses to verify this day checking:
HKEY_CURRENT_USER\Software\ Microsoft\Office\8.0\Word
"xix3beta1"="notyet"
    If the day of the week is Monday, the following text is written to the file "c:\windows\system\WIN32WD.DR1":
"-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=                " __________ WELCOME TO THE ATROCITY"
                " / / EXHIBITION! NATO has"
                " ___ / ______/ invented a new kind of"
                " | | / / peace. And they make it"
                " | | \/\/ with bombs! They kill"
                " | |____ __________ civilians, intimidate"
                " | / _/ / < / journalists because"
                " |______/ / \/ >___ / they show and write"
                " / ___ \ / / other points of view,"
                " ( |__/) / / / bomb hospitals, destroy"
                " (\ ___/ _/ /___/ factories causing"
                " (\ ___\(/ enviromental damages,"
                " (\ ___) embassies, etc. WE ARE"
                " \ __) ALL TARGETS! Today"
                " _____ Yugoslavia, tomorrow?"
                " / ~~~/"
                " /________/ May'99 - xix-lx/pt"
                "-=-=-=-=-=-=-=-=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
    This appears to be the universal symbol of NAZI-ism. The registry is then checked for a flag value modification to the setting; if the value "xix3beta1" does not equal "ok" then the startup file AUTOEXEC.BAT is then modified to use the "TYPE" command to display the text file shown above. The registry is then modified such that "xix3beta1"="ok". Lastly, in the current document, the Comments property is modified to contain "drop klinton, not bombs!".
    During startup of Word97, if the global template NORMAL.DOT is infected by this virus, the subroutine Autoexec runs. This code writes additional virus source code to a file "c:\windows\system\WD1_.DRV" containing a subroutine FileSave. This source code is then imported into the current active document as a module named "WD_" and the document is saved as a template into the startup path as "WORD97.DOT" and is closed. This file will load at next Word startup.
Send This Virus Information To A Friend?