Nuclear | |
---|---|
Type | Macro virus |
Creator | Unknown |
Date Discovered | 1995.09 |
Place of Origin | Unknown |
Source Language | Visual Basic |
Platform | MS Word |
File Type(s) | .doc |
Infection Length | 9 macro modules |
Reported Costs |
Nuclear is an early macro virus, appearing shortly after Concept. Unlike Concept however, Nuclear does not announce its infection and it is both irritating and destructive, inserting a potentially embarrassing political slogan in printed and faxed documents, as well as deleting important system files.
Behavior
When a document infected with Nuclear is executed, it adds its macros to the NORMAL.DOT template. Nuclear turns off the option to prompt the user before saving NORMAL.DOT in order to hide its presence. Its macros include:
- AutoExec
- AutoOpen
- FileExit
- FilePrint
- FilePrintDefault
- FileSaveAs
- DropSuriv
- PayLoad
- InsertPayload
- list item
The DropSuriv macro checks if the time is between 17:00 and 17:59, and if so drops the Ph33r Windows .exe virus. On the fifth of April, the PayLoad macro deletes DOS system files including IO.SYS, MSDOS.SYS and COMMAND.COM. While printing or faxing, the virus inserts two lines of text at the end of every twelfth document in the last five seconds of every minute saying:
And finally I would like to say:
STOP ALL FRENCH NUCLEAR TESTING IN THE PACIFIC
Effects
France ended nuclear testing in the Pacific in 1996, after 30 years of tests there. It is extremely unlikely the virus caused the French government to end the nuclear tests. The virus likely was an expression of the unpopular global sentiment towards testing in the pacific, given that it was causing health problems for people in the region.
Origin
Nuclear was written by an unknown virus author and the Ph33r virus it drops was created in Australia by Qark of the VLAD virus group. The first Nuclear infected file was posted to a message board as Ww6Info.doc, which was supposed to be an article by Eugene Kaspersky on the new Concept virus.
Sources
Niels Bjergstrom. WordMacro.Nuclear virus. 1995.09.18
Howard Fuhs. Makro-Viren. 1995.10
Paul Ducklin. Sophos, Winword-Nuclear - Another Word Macro Virus. 1995.09.14
George Rudzinski. New macro viruses target Word document files. 1995.08.23-10.27
Mikko Hypponen. F-Secure Antivirus, F-Secure Virus Descriptions : Nuclear.
Lindsay Vincent Papeete. The Grauniad, French accused of Pacific nuclear cover-up. 2006.01.01
Qark. Interview with Qark/VLAD.