Global sites

Threat Encyclopaedia

Chack.B

W97M/Chack.B is a macro virus operating in the Microsoft Word 97 environment. It attacks active documents and the global template normal.dot. It consists of two modules - CyberHack and CyberForm. The first one contains the virus code and in the second one is its activating routine.

After the infected document is opened the virus turns off the Word anti-virus protection and disables displaying of warning at writing into the global template and of all other warnings. It makes the Visual Basic editor inaccessible, deletes the item Tools/Macro in the menu and prohibits the keyboard shortcuts ALF+F11 and ALT+F8. Then it attacks the global template normal.dot and opened documents. After the global template was infected the virus attacks all documents when they are created, opened, saved and closed. After attacking documents it renews displaying the warning windows.
On Fridays it runs the macro CyberForm upon closing a document. The virus presents itself in the same way at an attempt to open the Word item Help/About Microsoft Word. That macro displays a dialogue with a picture.
At the beginning of the virus body is the following text:

' Macros By WinK'S Hacker
' Picture By Casper Satan

' Lebih baik mencoba dari pada tidak tahu sama sekali ...
' Mohon ma'af bila telah mengganggu Anda.
' Microsoft memang gila ! Nambahin fasilitas pemrogramannya
' keterlaluan untuk suatu word prosesor.