This macro virus infects two Office97 applications: Word documents and Excel sheets. To be compatible with different Office97 applications the virus uses VisualBasic compatibility and uses the same code in both Word and Excel.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note: You need administrative rights to change the settings.
The virus infects the system, documents and sheets when files are opened (auto-macros AutoOpen in Word and Auto_Open in Excel). While infecting the virus uses the export/import Office97 functions via a temporary C:\SHIVER.SYS file. It writes (exports) its code to this file and then reads (imports) into the object that is being infected.
Under both Word and Excel the virus replicates itself by using standard tricks. While infecting Word files the virus copies its code to document or global macros area (NORMAL.DOT). Under Excel the virus hooks sheets activation process and sets the infection macros ShiverTime as the handler. The virus also saves the infected PERSONAL.XLS file in the Excel startup directory and as a result infects the system Excel area.
When leaving Word (AutoExit) the virus attempts to spread its code from Word to Excel. The virus uses the DDE functions: it runs Excel in minimized windows and pass to there data and commands necessary to create the infected PERSONAL.XLS file in the Excel startup directory. The virus infects Word from Excel by using similar way: it runs minimized Word, opens Visual Basic Editor and reads its code from the C:\SHIVER.SYS file.
The virus does not delete its C:\SHIVER.SYS file after infection and uses it to re-infect Word if the main virus code was deleted (disinfected) in documents and NORMAL.DOT. To do that the virus on each Word startup looks for WORD8.DOT file in the Word startup directory. If there is no such file, the virus creates it and writes a short FileSaveAs macro to there. This macro contains just a few commands that import the virus code from the C:\SHIVER.SYS into documents that are saved with new name. As a result the virus stays active ever if all documents and NORMAL.DOT are disinfected. The virus uses the same export/import way to create the WORD8.DOT dropper, as a source code buffer the C:\SENTRY.SYS file is used.
To detect its presence in the system the virus uses the system Registry and writes its ID-values into the key "HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Office\8.0". There are two values that mark virus presence/absence in the system:
Shiver[DDE] = ALT-F11 Shiver[DDE] = NoNos(
Based on the system random counter the virus resets this key to "NoNos(" and forces its infection routines renew the infected WORD8.DOT and PERSONAL.XLS in the Word and Excel startup directories.
The virus contains these texts:
Shiver[DDE] by ALT-F11 with help from ALT-F4 This is the first virus produced by The Alternative Virus Mafia (AVM) ALT-F4 - "I was born for dying" ALT-F11 - "Actions without thoughts"
The virus has stealth abilities. Under Excel it disables the menu items IWindow/Unhide... and Tools/Macro. Under Word it also creates the stealth macros in the NORMAL.DOT: ToolsMacro, FileTemplates, ViewVBCode in the module "ThisDocument". As a result the virus hides its code. The virus also disables the Office97 virus protection.
Based on the system random counter the virus runs following effects:
- in Excel it inserts into random selected cell the comments:
Shiver[DDE] by ALT-F11
- in Word it creates the C:\SISTER.DLL file, writes the text to there and runs WRITE to show it:
Hey Man, I Kinda Like Your Sister Hey Man, I Hope That's Cool Hey Man, I Kinda Lose My Mind Every Single Time I Find Your Sister Suntanned By The Pool Hey Man, I Wanna See Her Naked Hey Man, I'm Always In Her Room All Alone When No One's There Going Through Her Underwear Hey Man, I Gotta See Her Soon Hey Man, I'll Never Get Her Pregnant But Hey Man, How Can I Resist Her The Day I Give Her A Wedding Band Are You Going To Be My Best Man? Hey Man, I Kinda Like Your Sister I Kinda Like Your Sister I Kinda Like Your Sister I Kinda Like Her
- in Word it renames the menu items:
Tools/Macro = "Shiver[DDE] by ALT-F11" File/Versions... = "Cum Stained Sheets..." Edit/Paste Special... = "Hey Man I Did Your Mom..." Insert/Break... = "Wanna do some MDMA ?" Help/About Microsoft Word = "Peace, Love and Drugs" File/Properties = "I'll die happy, you'll just die" Edit/Go To... = "Heywood Jablowmi" Tools/Word Count... = "Body Count" Format/Font... = "Cunt" File/Close = "No Clothes" Window/Split = "Blow Me" Insert/Picture = "Crusty Porn GIF" File/Print... = "My Balls Itch" Format/Bullets and Numbering... = "Pills And Needles" Table/Insert Table... = "Insert and Probe" Tools/Customize... = "Sodomize..." Tools/Spelling and Grammar... = "Spelling and Your Grandma..." View/Toolbars = "Gaybars" View/Master Document = "Masturbation"