Nuclear
Nuclear
Type Macro virus
Creator Unknown
Date Discovered 1995.09
Place of Origin Unknown
Source Language Visual Basic
Platform MS Word
File Type(s) .doc
Infection Length 9 macro modules
Reported Costs

Nuclear is an early macro virus, appearing shortly after Concept. Unlike Concept however, Nuclear does not announce its infection and it is both irritating and destructive, inserting a potentially embarrassing political slogan in printed and faxed documents, as well as deleting important system files.

Behavior

When a document infected with Nuclear is executed, it adds its macros to the NORMAL.DOT template. Nuclear turns off the option to prompt the user before saving NORMAL.DOT in order to hide its presence. Its macros include:

  • AutoExec
  • AutoOpen
  • FileExit
  • FilePrint
  • FilePrintDefault
  • FileSaveAs
  • DropSuriv
  • PayLoad
  • InsertPayload
  • list item

The DropSuriv macro checks if the time is between 17:00 and 17:59, and if so drops the Ph33r Windows .exe virus. On the fifth of April, the PayLoad macro deletes DOS system files including IO.SYS, MSDOS.SYS and COMMAND.COM. While printing or faxing, the virus inserts two lines of text at the end of every twelfth document in the last five seconds of every minute saying:

   And finally I would like to say:
      STOP ALL FRENCH NUCLEAR TESTING IN THE PACIFIC

Effects

France ended nuclear testing in the Pacific in 1996, after 30 years of tests there. It is extremely unlikely the virus caused the French government to end the nuclear tests. The virus likely was an expression of the unpopular global sentiment towards testing in the pacific, given that it was causing health problems for people in the region.

Origin

Nuclear was written by an unknown virus author and the Ph33r virus it drops was created in Australia by Qark of the VLAD virus group. The first Nuclear infected file was posted to a message board as Ww6Info.doc, which was supposed to be an article by Eugene Kaspersky on the new Concept virus.

Sources

Niels Bjergstrom. WordMacro.Nuclear virus. 1995.09.18

Howard Fuhs. Makro-Viren. 1995.10

Paul Ducklin. Sophos, Winword-Nuclear - Another Word Macro Virus. 1995.09.14

George Rudzinski. New macro viruses target Word document files. 1995.08.23-10.27

Mikko Hypponen. F-Secure Antivirus, F-Secure Virus Descriptions : Nuclear.

Lindsay Vincent Papeete. The Grauniad, French accused of Pacific nuclear cover-up. 2006.01.01

Qark. Interview with Qark/VLAD.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License