Description
This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it’s quite common for viruses to do nothing more than spread from one system to another.
Indication of Infection
On an infected system the virus hides the FILE|TEMPLATES, TOOLS|MACRO, and TOOLS|CUSTOMIZE functionality. Warning: It is important not to use these commands, as you will execute the viral code. If the TOOLS|MACRO command is used a ‘Microsoft Word Err=1022’ MessageBox will be displayed and Word will quit because of a mistake in coding. If the user opens a file on the 1st or the 13th the same error message is displayed.
On the first infection a mistake in coding causes a ‘WordBasic Err=102’ MessageBox to be displayed.
Virus Characteristics
This virus propagates by infecting Word Documents in Microsoft WORD Versions 6.x / 7.x on Windows and Macintosh platforms. The virus consists of these macros:
ACTION, ACTIONDATE, AUTOEXEC, AUTOOPEN, EDITAUTOTEXT, FILEPRINT, FILEPRINTDEFAULT, FILETEMPLATES, STDCLOSE, TOOLSMACRO
in an infected document. Their names change to:
ACTION, ACTIONDATE, AUTOCLOSE, DEFEATAV, EDITAUTOTEXT, FILEPRINT, FILEPRINTDEFAULT, FILETEMPLATES, STDOPEN, TOOLSMACRO
in Word’s Global Template NORMAL.DOT. The virus becomes active by using Auto- and SystemMacros. All macros are encrypted using the standard Word execute-only feature, which means that the user is unable to edit or view the macro code.
Variants
| Virus Name | Type | Subtype | Differences |
| WM/CVCK1.B | Virus | Macro | |
| WM/CVCK1.E | Virus | Macro | Contains minor code changes |