Fandom

Malware Wiki

WallPaper

1,345pages on
this wiki
Add New Page
Comments0 Share

Virus.MSWord.WallPaper or WallPaper is a virus that runs on Microsoft Windows.

Details

WallPaper is an encrypted macro virus on Microsoft Word. It contains two original macros, but while infecting global macros area the AutoOpen macro is copied to four macros:

Documents    NORMAL.DOT

FilePrint -> FilePrint

autoOpen  -> autoOpen

ToolsMacro

FileTemplates

ToolsCustomize

The virus infects the documents on all calls that are listed above (opening or printing a file, entering menus File/Templates, Tools/Macro, Tools/Customize) and copies itself to global macros on opening an infected document. The virus drops the SK2.BMP file that contains an image of a death's head. On the 31st of any month the virus modifies the profile section [Desktop] (the WIN.INI file):

[Desktop]

Wallpaper=SK2.BMP

TileWallPaper=1

SK2=

And increases SK2 value on each infection. It also creates the C:\WINDOWS\REGSK2.REG and writes the text to there:

REGEDIT4

[HKEY_CURRENT_USER\Control Panel\Desktop]

"TileWallpaper"="1"

"Wallpaper"="C:\\WINDOWS\\SK2.BMP"

The virus then appends the following commands to the C:\AUTOEXEC.BAT file :

@echo off

c:

cd c:\windows

copy /y SK2.BMP c:\windows\sk2.bmp >nul

regedit regsk2.reg >nul

On the same date (31st) the virus, depending on the system time, displays the dialog:

[!!!PIRATE VIRUS!!!]-- Active!

The [PIRATE VIRUS] has pillaged your computer!

GO BACK TO MS-WORD??

Videos

Virus.MSWord01:15

Virus.MSWord.WallPaper

Virus.MSWord04:53

Virus.MSWord.Wallpaper

Virus.MSWord.Wallpaper

WallPaper Macro Virus High Quality00:44

WallPaper Macro Virus High Quality

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.