|
Softpanorama |
May the source be with you, but remember the KISS principle ;-)
|
Version 2.7b/rev.6 (07/08/97)
1. Introduction
2. Detection
3. Removal
3.1. How to remove the virus from all files
3.2. How to restore or delete NORMAL.DOT template
4. Damage
5. List of macros in the CAP.A virus
The CAP macro virus exists in several strains (A, E, I, G, and H). Strain A seems to be the most widespread. The CAP.A was found at NJ in May 1997. Currently several sites have problems with this virus and this memo provide information than can help to prevent further spread of the virus. This macro virus was discovered in February 1997. WEB sites of all major AV vendors (DataFellows( Data Fellows' Virus Information Pages: CAP ), McAfee( Virus Information Library/Cap ), Dr.Solomon ( Virus Encyclopedia Description/Cap )) contain information about the virus. AFAIK Strains E, I, G, and H were not detected in NJ yet. They behave similarly to strain A.
CAP.A virus is not operational in Word 97 environment. So even if user will answer enable macros on warning screen during conversion virus will be damaged/disabled during conversion to VBA5 and will not be able to infect NORMAL.DOT template and other documents. So upgrading to Ms Word 97 is the best option available as for defence from this virus.
ATTENTION:
MORE < filename
command to view the file. See DOC2RTF.HTM on step by step instruction how to check the format of the document.
After infection of the MS Word, the CAP.A virus modifies the Tools menu by removing the option Macro. The simplest way to detect the virus is to see if the option Macro is present in the Tools menu. In order to protect itself, the virus also removes the Tools|Customize menu and disables the File|Templates menu.
Note: If an icon for the list of macros was present on the toolbar, it will be still present, however pushing the button will do nothing.
The removal of the CAP.A macro virus should be done in two steps:
To perform the first step, one must have the F-MACRO.EXE v.2.08 or later. there are 2 variants of F-macro invocation:
F-MACRO <drive ot directory> /ALL /DISINF
fmacro <drive or directory> /ALL /DISINF
Attention: Only versions of F-MACRO after 2.12b detect and disinfect the virus.
Sometimes if documents are extremely valuable it's wise first to backup infected files before disinfection. List of infected files can be produced by running
FMACRO <drive or directory> /LIST /ALL
(in this case hard copy of the list will be saved in the file C:\TEMP\ANTIVIR\F-MACRO.LST)
or calling F-MACRO.EXE directly from some directory. For example:
F-MACRO <drive or directory> /ALL /REPORT=C:\TEMP\ANTIVIR\F-MACRO.LST
After the FMACRO.BAT or F-MACRO finishes, please print the file F-MACRO.LST. Now you
have list of infected files on C: drive .
Repeat this process with the Z: drive.
For valuable documents conversion to RTF is preferable as a disinfection method. See DOC2RTF.HTM for details. It should be stressed that the conversion to RTF is generally the most reliable method of destroying any macro virus, not only CAP.A virus. So if content of documents is important and no backup copies are in existence, this is the way to go. For less important documents, F-MACRO.EXE will be the quicker method of disinfecting a lot of files.
Disinfection should be done on all documents that are listed in CAP_A.LST (produced in the previous step) even if some of them have extensions RTF, because sometimes the user doesn't change the "type" of the file in the "Save As" box and just stores document in the native MS Word format, but with extension RTF instead of extension .DOC. Such documents can be infected and any native MS Word document. See DOC2RTF.HTM for details. The following commands can be used to check documents independently of extension:
FMACRO C: /DISINF /ALL (will disinfect all infected documents with extensions .DOC and DOT and RTF.)
One can also use F-MACRO directly without any batch file
Y:\DOS\UTILS\FPROT\F-MACRO C: /DISINF /ALL (calling
F-MACRO.EXE from the disk).
After disinfecting files, one needs to delete or restore from the backup the NORMAL.DOT template (if it is not stored on the write protected LAN drive).
If the global template (NORMAL.DOT) is stored locally on the C: drive or on the user network drive (Z:), and you have write access to it you can either restore it from the backup copy or try to restore the standard toolbar in MS Word. To do this, one needs to go to: View/Toolsbars., then highlight Standard in the Toolbars list and press the Reset button. That should do the trick
If not and you have no backup copy of the NORMAL.DOT template, than your only option is to delete NORMAL.DOT. You will lose all customizations you have done to the toolbars (other than Standard - you will lose them anyway) and menus, if any. Also by the fact of being infected ( you already had lost all macros in the NORMAL.DOT template. See ). The next time Word for Windows is started, it will create a new global template file. Deletion of NORMAL.DOT will, of course, remove the menu customizations made by the virus (including the missing menu items, like Tools/Macro and Tools/Customize). If you have valuable customization (system macros, toolbar or menu changes) in NORMAL.DOT, your only chance is to have backup copy of the NORMAL.DOT template and restore it.
If you disinfect document by converting it to RTF and your NORMAL.DOT template is not
protected, it is still necessary to remove your NORMAL.DOT.
(it will still be infected by the virus even if document was saved in DRT format and does
not contain the virus anymore).
To remove NORMAL.DOT one needs to delete the file C:\MSOFFICE\WINWORD\TEMPLATE\NORMAL.DOT
in Winword 6.0 installations and file C:\MSOFFICE\TEMPLATE\NORMAL.DOT in
MS Word 95 and 97 installations. You can remove this file if and only if all your MS Word
sessions are closed.
In Office 95 or 97, if MS Word is your default mail viewer, than opened e-mail is actually
an MS Word session. So all opened e-mails should be closed. After removing the file one
needs to start and then exit Word. This will create a new copy of the NORMAL.DOT file. If
some customizations are lost you need to restore them manually.
The virus damages the global template by removing the system macros defined within it.
The virus consists of ten basic macros; and up to five additional macros taken from the menus, if their version of MS Word is localized (for example, German).
Although the list of macros could not be seen from the Tools menu directly, CAP contains 10 encrypted macros:
Structurally one large macro, called CAP, (which gives the virus its name), is called from the virus' other macros - AutoExec, AutoOpen, FileSave, FileSaveAs, FileTemplates, ToolsMacro, FileClose, FileOpen and AutoClose.
The virus uses information from the macro description field, (located at the bottom of the Tools/Macro dialog), for self-recognition of its core macros. These contain F% at the beginning of a description (FileOpen contains F%O, FileClose contains F%C, FileSave contains F%O and FileSaveAs contains F%SA).
When the virus replicates, the first thing it does is to copy the basic set of 10 macros. The virus then browses Word for Windows menu items, collects their names (they could be different in different languages, or customized versions of Word for Windows) and intercepts up to five of these additional macros, inserting a pointer to the main CAP macro. The virus also removes the menu items Tools/Macro and Tools/Customize. The File/Templates menu item is present after infection, but it does not work.
Again, all macros are encrypted. After the text of the macros is decrypted, the following texts could be found in comments to the macro texts:
'C.A.P: Un virus social.. y ahora digital..
'"j4cKy Qw3rTy" (jqw3rty@hotmail.com).
'Venezuela, Maracay, Dic 1996.
'P.D. Que haces gochito ? Nunca seras Simon Bolivar.. Bolsa !
It is therefore assumed that the virus originated in Venezuela.
Copyright © 1996-2008 by Dr. Nikolai Bezroukov. www.softpanorama.org was created as a service to the UN Sustainable Development Networking Programme (SDNP) in the author free time. Submit comments This document is an industrial compilation designed and created exclusively for educational use and is placed under the copyright of the Open Content License(OPL). Original materials copyright belong to respective owners. Quotes are made for educational purposes only in compliance with the fair use doctrine.
Standard disclaimer: The statements, views and opinions presented on this web page are those of the author and are not endorsed by, nor do they necessarily reflect, the opinions of the author present and former employers, SDNP or any other organization the author may be associated with. We do not warrant the correctness of the information provided or its fitness for any purpose.
Last modified: February 28, 2008