Type Macro virus
Date Discovered 1997.02.18
Place of Origin United States
Source Language Visual Basic
Platform MS Word
File Type(s) .doc
Infection Length 9 macro modules
Reported Costs

Sharefun is the first virus to propogate via email. Based partially on Wazzu, it predates Melissa, a much more famous Word Macro that spread through email.


Sharefun consists of nine macros: AutoExec, autoOpen, FileClose, FileExit, FileSave, FileOpen, FileTemplates, ToolsMacro, ShareTheFun.

When an infected file is executed, there is a 1 in 4 chance that the virus will activate. It disables the Macro menu under Tools, to make it impossible to see the added macros. If the user manages to get to these in some other way, it will infect NORMAL.DOT.

If it does not find Microsoft Mail in the running tasks, it will shut down Windows. If Microsoft Mail is running the virus will send a copy of itself to three random email addresses in them MSMail alias list. The email it sends will have the subject line "You have GOT to see this!" The message will be blank with a word document attached named DOC1.DOC, which contains the virus.


Unlike other macro viruses of its time, Sharefun had very few variants. There is a B variant that is similar in most respects. There is a 3 in 20 chance this virus will move a random word to a random place in the file. There is a 1 in 25 chance that it will delete all files on drive C:.


For a virus that can spread through email when no others did, Sharefun ironically failed to become widespread.

McAfee claimed credit for discovering the virus, and there is no indication that McAfee used someone else's description, as they did with Bliss. McAfee also created the first disinfector for the virus.


Mikko Hypponen. F-Secure Antivirus, F-Secure Virus Descriptions : ShareFun.

Kaspersky Lab.,Virus.MSWord.ShareFun. 2000.01.12

Business Wire, Mcafee Discovers Sharefun Virus; First Macro Virus To Automatically Email Itself To Unsuspecting Victims. 1997.02.24

McAfee Antivirus, WM/SHAREFUN.B. 1997.04.15

Nikolai Bezroukov. Softpanorama, ShareFun Macro virus. 1998

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License