| Sharefun | |
|---|---|
| Type | Macro virus |
| Creator | |
| Date Discovered | 1997.02.18 |
| Place of Origin | United States |
| Source Language | Visual Basic |
| Platform | MS Word |
| File Type(s) | .doc |
| Infection Length | 9 macro modules |
| Reported Costs | |
Sharefun is the first virus to propogate via email. Based partially on Wazzu, it predates Melissa, a much more famous Word Macro that spread through email.
Behavior
Sharefun consists of nine macros: AutoExec, autoOpen, FileClose, FileExit, FileSave, FileOpen, FileTemplates, ToolsMacro, ShareTheFun.
When an infected file is executed, there is a 1 in 4 chance that the virus will activate. It disables the Macro menu under Tools, to make it impossible to see the added macros. If the user manages to get to these in some other way, it will infect NORMAL.DOT.
If it does not find Microsoft Mail in the running tasks, it will shut down Windows. If Microsoft Mail is running the virus will send a copy of itself to three random email addresses in them MSMail alias list. The email it sends will have the subject line "You have GOT to see this!" The message will be blank with a word document attached named DOC1.DOC, which contains the virus.
Variants
Unlike other macro viruses of its time, Sharefun had very few variants. There is a B variant that is similar in most respects. There is a 3 in 20 chance this virus will move a random word to a random place in the file. There is a 1 in 25 chance that it will delete all files on drive C:.
Effects
For a virus that can spread through email when no others did, Sharefun ironically failed to become widespread.
McAfee claimed credit for discovering the virus, and there is no indication that McAfee used someone else's description, as they did with Bliss. McAfee also created the first disinfector for the virus.
Sources
Mikko Hypponen. F-Secure Antivirus, F-Secure Virus Descriptions : ShareFun.
Kaspersky Lab. Securelist.com,Virus.MSWord.ShareFun. 2000.01.12
Business Wire, Mcafee Discovers Sharefun Virus; First Macro Virus To Automatically Email Itself To Unsuspecting Victims. 1997.02.24
McAfee Antivirus, WM/SHAREFUN.B. 1997.04.15
Nikolai Bezroukov. Softpanorama, ShareFun Macro virus. 1998