From...

July 1, 1999
Web posted at: 8:44 a.m. EDT (1244 GMT)

by Winnie Lai

ALSO:

New 'Trojan Horse' strain may go mainstream    Message Boards:    How do you define a hacker?    Computer viruses    In-Depth Special:    Insurgency on the Internet    For more computing stories

HONG KONG (IDG) -- A computer virus dubbed July Killer is expected to strike July 1. Active only during July, it will infect Microsoft Corp.'s Word 97 documents via a Visual Basic macro, according to antivirus specialists.

"The virus was discovered only recently and has a destructive payload," said Michael Lai, a system engineer at Trend Micro Inc. in Hong Kong. "It can wipe out the hard disk's contents."

"It is fierce because when an infected document is opened, it will first infect the global template, normal.dot, and thus opening other documents would lead to infection as well," Lai said.

During July, users who open an infected Word document will see a dialog box entitled "A wake up call for the generation." If the user clicks the OK button, a message will appear that says, "You are wise, please choose this again later. Congratulations."

If the user chooses the "cancel" button three times, another message appears: "Stop it! You are so incurable to lose three chances! Now, god will punish you."

The virus will then open the autoexec.bat file and add the command line "deltree/y c:\" to the file. The next time the user boots the machine, all files in the hard disk will be deleted, according to Lai.

He noted that users who have updated their systems recently will likely have the current fix for July Killer and should be safe.

"Users who don't renew their antivirus software regularly are vulnerable," Lai warned.