W97M/VMPCK1.DD is a macro virus operating in the Microsoft Word 97 environment. It uses the "class" method of infection – it attacks the module "ThisDocument" which is present as a standard in each Word document or template. It attacks the global template normal.dot and Word documents. Presence of the virus is manifested by existence of the module with the name CAPut in the infected document
When an infected document is opened W97M/VMPCK1.DD is finding out whether the module named CAPut exists in the global template. If there is no module of that name there the virus turns off the anti-virus protection and disables displaying of warning windows at writing into templates and at macros conversion. After that the virus exports its code to the file c:\system.drv and attacks the template from there. The virus attacks documents when they are being opened, closed, saved or saved under different name as well as when the Visual Basic editor is used.
Upon attacking files in an open document the virus substitutes with the chance of 1:100 the string "19" by the string "CAPut!'". When making this change the virus disables access to menu items which could reverse this operation and saves the altered document.
When attacking a document the virus always adds to its properties the commentary text JU$t bEEn CAPuted!. When an attempt is made to call the window Help/About Microsoft Word the virus displays the window:

The virus disables access to the Word menu items Tools/Macro, Tools/Templates and accessories and to the Visual Basic editor. Instead of them it runs the virus macro and displays a window with a false error message:

In the virus code there is a line with a note:

' CAPut! by --=|| N|c0t|N ||=-- 1998

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.