|Place of Origin||Maracay, Venezuela|
|Infection Length||10 Macro modules|
The CAP virus consists of 10 or 15 macros, depending on the language version of Word. If it infect a computer on the English version, it will consist of the following ten macros:
On a non-English version of Word, it creates an additional five, which are simply copies of the last five on the above list. When an infected file is opened, CAP removes the macros in NORMAL.DOT and replaces them with its own. It removes the options of Macros and Customize under the Tools drop menu, as well as Templates under file. If there is an icon on the toolbar, it will still be there, but it will not function.
When the macros are decrypted, the following text can be seen:
'C.A.P: Un virus social.. y ahora digital.. '"j4cKy Qw3rTy" (firstname.lastname@example.org). 'Venezuela, Maracay, Dic 1996. 'P.D. Que haces gochito ? Nunca seras Simon Bolivar.. Bolsa !
This translates into: "'C.A.P: A social virus, and now a digital one. (The next two lines are about the creator and the time and location of the virus's creation.) PS, What are you doing little cowboy? You will never be Simon Bolivar! Stupid!
CAP is unable to function in Word version 97 and above.
Like a number of macro viruses of its time, CAP produced a very high number of variants, most are too similar to the original to merit mention. One variant, Capcop is a complete rewrite of the original, and some antivirus products detect it as a different family.
CAP became pretty wide spread in the western hemisphere. It reached New Jersey by May of 1997. It had reportedly spread around the whole world within weeks of its release.
Nikolai Bezroukov. Softpanorama, The CAP Macro virus. 1997.07.08
Vesselin Bontchev. Frisk Software, Macro Virus Identification Problems.
Lord Julus. Interview with Jacky Qwerty. 1999.08
LocalSpanish, Slang term from Venezuela "bolsa".