Malware Defense History

by Dr. Nikolai Bezroukov.

Copyright: Dr. Nikolai Bezroukov 1994-2013. Unpublished notes. Version 0.80.October, 2013

Contents : Foreword : Ch01 : Ch02 : Ch03  : Ch04 : Ch05 : Ch06 : Ch07 : Ch08 : Ch09 : Ch10 : Ch11 : Ch12 : Ch13

Chapter 5: Macro Viruses

Version 2.7b/rev.6 (07/08/97)

The CAP Macro virus

Contents

1. Introduction

2. Detection

3. Removal

    3.1. How to remove the virus from all files

    3.2. How to restore or delete NORMAL.DOT template

4. Damage

5. List of macros in the CAP.A virus

1. Introduction

The CAP  macro virus exists in several strains (A, E, I, G, and H). Strain A seems to be the most widespread. The CAP.A was found at NJ in May 1997. Currently several sites have problems with this virus and this memo provide information than can help to prevent further spread of the virus.  This macro virus was discovered in February 1997. WEB sites of all major AV vendors (DataFellows( Data Fellows' Virus Information Pages: CAP ), McAfee( Virus Information Library/Cap ),  Dr.Solomon ( Virus Encyclopedia Description/Cap )) contain information about the virus. AFAIK Strains E, I, G, and H were not detected in NJ yet. They behave similarly to strain A.

CAP.A virus is not operational in Word 97 environment. So even if user will answer enable macros on warning screen during conversion virus will be damaged/disabled during conversion to VBA5 and will not be able to infect NORMAL.DOT template and other documents. So upgrading to Ms Word 97 is the best option available as for defence from this virus.

ATTENTION:

• The virus deletes all macros in the MS Word global template NORMAL.DOT. The virus  gets rid of the Tolls|Macro and Tolls|Customize options.  It also disables the File|Template option.  If will perform an autosave when closing a document.
• If user tries to save document in RTF format it will be saved in native Word format as virus will modify operation. So after saving file in RTF format please check if it really saved in RTF format by opening it in Notepad or if file is big going to DOS and using

         MORE < filename

command to view the file. See DOC2RTF.HTM on step by step instruction how to check the format of the document.

2. Detection

After infection of the MS Word, the CAP.A virus modifies the Tools menu by removing the option Macro. The simplest way to detect the virus is to see if the option Macro is present in the Tools menu. In order to protect itself, the virus also removes the Tools|Customize menu and disables the File|Templates menu.

Note: If an icon for the list of macros was present on the toolbar, it will be still present, however pushing the button will do nothing.

3. Removal

The removal of the CAP.A macro virus should be done in two steps:

• Remove the virus from all infected files
• Delete or, if backup is available, restore the NORMAL.DOT template (see below on how to restore the Standard toolbar).

3.1. How to remove the virus from all files

To perform the first step, one must have the F-MACRO.EXE v.2.08 or later. there are 2 variants of F-macro invocation:

• It can be run directly by using command string

         F-MACRO <drive ot directory> /ALL /DISINF

• Or using the FMACRO.BAT file:

        fmacro <drive or directory> /ALL /DISINF

Attention: Only versions of F-MACRO after 2.12b detect and disinfect the virus.

Sometimes if documents are extremely valuable it's wise first to backup infected files before disinfection. List of infected files can be produced by running

    FMACRO <drive or directory>  /LIST /ALL

(in this case hard copy of the list will be saved in the file C:\TEMP\ANTIVIR\F-MACRO.LST)

or calling F-MACRO.EXE directly from some directory. For example:

    F-MACRO <drive or directory>  /ALL /REPORT=C:\TEMP\ANTIVIR\F-MACRO.LST  

After the FMACRO.BAT or F-MACRO finishes, please print the file F-MACRO.LST. Now you have list of infected files on C: drive .
Repeat this process with the Z: drive.

For valuable documents conversion to RTF is preferable as a disinfection method. See DOC2RTF.HTM  for details. It should be stressed that the conversion to RTF is generally the most reliable method of destroying any macro virus, not only CAP.A virus. So if content of documents is important and no backup copies are in existence, this is the way to go. For less important documents, F-MACRO.EXE will be the quicker method of disinfecting a lot of files.

Disinfection should be done on all documents that are listed in CAP_A.LST (produced in the previous step) even if some of them have extensions RTF, because sometimes the user doesn't change the "type" of the file in the "Save As" box and just stores document in the native MS Word format, but with extension RTF instead of extension .DOC. Such documents can be infected and any native MS Word document. See DOC2RTF.HTM for details. The following commands can be used to check documents independently of extension:

    FMACRO C: /DISINF /ALL (will disinfect all infected documents with extensions .DOC and DOT and RTF.)

One can also use F-MACRO directly without any batch file

    Y:\DOS\UTILS\FPROT\F-MACRO C: /DISINF /ALL (calling F-MACRO.EXE from the disk).
 

3.2. How to restore or delete the NORMAL.DOT template

After disinfecting files, one needs to delete or restore from the backup the NORMAL.DOT template (if it is not stored on the write protected LAN drive).

If the global template (NORMAL.DOT) is stored locally on the C: drive or on the user network drive (Z:), and you have write access to it you can either restore it from the backup copy or try to restore the standard toolbar in MS Word. To do this, one needs to go to: View/Toolsbars., then highlight Standard in the Toolbars list and press the Reset button. That should do the trick

If not and you have no backup copy of the NORMAL.DOT template, than your only option is to delete NORMAL.DOT. You will lose all customizations you have done to the toolbars (other than Standard - you will lose them anyway) and menus, if any. Also by the fact of being infected ( you already had lost all macros in the NORMAL.DOT template. See ). The next time Word for Windows is started, it will create a new global template file. Deletion of NORMAL.DOT will, of course, remove the menu customizations made by the virus (including the missing menu items, like Tools/Macro and Tools/Customize). If you have valuable customization (system macros, toolbar or menu changes) in NORMAL.DOT, your only chance is to have backup copy of the NORMAL.DOT template and restore it.

If you disinfect document by converting it to RTF and your NORMAL.DOT template is not protected, it is still necessary to remove your NORMAL.DOT.
(it will still be infected by the virus even if document was saved in DRT format and does not contain the virus anymore).

To remove NORMAL.DOT one needs to delete the file C:\MSOFFICE\WINWORD\TEMPLATE\NORMAL.DOT in Winword 6.0 installations and file C:\MSOFFICE\TEMPLATE\NORMAL.DOT in MS Word 95 and 97 installations. You can remove this file if and only if all your MS Word sessions are closed.
In Office 95 or 97, if MS Word is your default mail viewer, than opened e-mail is actually an MS Word session. So all opened e-mails should be closed. After removing the file one needs to start and then exit Word. This will create a new copy of the NORMAL.DOT file. If some customizations  are lost you need to restore them manually.

4. Damage

The virus damages the global template by removing the system macros defined within it.

5. List of macros in CAP.A virus

The virus consists of ten basic macros; and up to five additional macros taken from the menus, if their version of MS Word is localized (for example, German).

Although the list of macros could not be seen from the Tools menu directly, CAP contains 10 encrypted macros:

• CAP,
• AutoExec,
• AutoOpen,
• FileSave,
• FileSaveAs,
• FileTemplates,
• ToolsMacro,
• FileClose,
• FileOpen,
• AutoClose.

Structurally one large macro, called CAP, (which gives the virus its name), is called from the virus' other macros - AutoExec, AutoOpen, FileSave, FileSaveAs, FileTemplates, ToolsMacro, FileClose, FileOpen and AutoClose.

The virus uses information from the macro description field, (located at the bottom of the Tools/Macro dialog), for self-recognition of its core macros. These contain F% at the beginning of a description (FileOpen contains F%O, FileClose contains F%C, FileSave contains F%O and FileSaveAs contains F%SA).

When the virus replicates, the first thing it does is to copy the basic set of 10 macros. The virus then browses Word for Windows menu items, collects their names (they could be different in different languages, or customized versions of Word for Windows) and intercepts up to five of these additional macros, inserting a pointer to the main CAP macro. The virus also removes the menu items Tools/Macro and Tools/Customize. The File/Templates menu item is present after infection, but it does not work.

Again, all macros are encrypted. After the text of the macros is decrypted, the following texts could be found in comments to the macro texts:

    'C.A.P: Un virus social.. y ahora digital..

    '"j4cKy Qw3rTy" ([email protected]).

    'Venezuela, Maracay, Dic 1996.

    'P.D. Que haces gochito ? Nunca seras Simon Bolivar.. Bolsa !

It is therefore assumed that the virus originated in Venezuela.

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March, 12, 2019