Threat Description

Jedi

Details

Aliases: Jedi, Jedi_Magic
Category: Malware
Type:
Platform: W32

Summary



This Word 97 virus contains two functions (AutoOpen and AutoExit) a in single module called Jedi_Magic. While infecting the global macros area the virus resets these system variables:

UserName = "O.B.1. Canobi"
  UserInitials = "OBC"
  UserAddress = "BOOGZI BARBERS ... Food Buster!!!"



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details



The virus detects already infected documents by the checking for the "Force" variable in which it saves the text: "567374-Joseph.A.D.G.". On exiting Word the virus resets its module's attributes:

VB_Description="Macro created 03/12/98 by Membership & Registry Division"
  VB_ProcData.VB_Invoke_Func = "Normal.Jedi_Magic.AutoExit"

[Eugene Kaspersky]






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More