| Satan | |
|---|---|
| Type | Word Macro virus |
| Creator | Mikee |
| Date Discovered | 1998 |
| Place of Origin | Quezon City, Philippines |
| Source Language | Visual Basic |
| Platform | MS Word |
| File Type(s) | .doc |
| Infection Length | 14 macro modules |
| Reported Costs | |
Satan, also known as Satan666 is a Word Macro virus appearing in the Philippines in the 1990's. It was remarkable for being the first able to evade the sophisticated Heuristic Macro Virus Scanner/cleaner. It was also very dangerous, deleting system files and user personal files under certain conditions.
Behavior
Satan consists of 14 macro modules, including Satan666, FileOpen, FileClose, FileSaveAs, FileSave, FileNew, AutoSave, AutoClose, AutoOpen, ToolsOptions, ViewVBCode and ToolsMacro. Most of the modules are responsibly for executing Satan666 after certain events, explained by the title of the modules.
On June, or when the user "disturbs" the virus, it deletes all files in the Windows folder, the System folder and My Documents. It may also modify AUTOEXEC.BAT. It will display a message box with the title "Hail Satan" and the text "Satan666 Word97 Virus".
Variants
There is only one variant. Satan.B consists of only 11 macros, similar to the original, but without ToolsOptions, ViewVBCode and ToolsMacro. It deletes files in the Windows and System folders, but doesn't bother with My Documents.
Origin
Satan was created by the virus coder Mikee from the Philippines. At the time, he was living in Novaliches City (a part of Quezon), about 25 kilometers from Makati City, where Onel A. de Guzman would write Loveletter only a couple years later. He gave it the name Satan because he was a Satanist and believed it was his will that made Satan a cool virus. Satan was his fourth macro virus.
Sources
Foxz. No Mercy Virus Team, Issue #1/week#1. 1998.05