Summary

For more information on macro viruses, see the description of WordMacro/Concept.

Documents infected with the Toten virus, contain two encoded macros: ReadMe (1834 bytes) and AutoOpen (223 bytes) and an infected NORMAL.DOT will contain two encoded macros as well: ReadMe (223 bytes) and DateiSpeichern (1834 bytes).

Additional Details

Toten encodes documents with a variable password. There is no chance for a user to open documents encoded by this virus. Toten is using the following passwords:

     condition                  password

     system date  <= 31.12.96   time + "TH" + date
     system date  <= 05.04.97   "TH" + time + "DTH"
     system date  <= 10.05.97   "TH" + date + time
     system date  <= 08.06.97   time + date + "40"
     system date  <= 29.08.97   date + time + "TH"
     system date  <= 20.12.97   "02117335498" + "DTH"
     system date  <= 31.12.97   time + "TH" + date
     system date  <= 05.04.98   "TH" + time + "DTH"
     system date  <= 10.05.98   "TH" + date + time
     system date  <= 08.06.98   time + date + "40"
     system date  <= 29.08.98   date + time + "TH"
     system date  <= 20.12.98   "02117335498" + "DTH"
     system date  <= 31.12.98   time + "TH" + date
     system date  <= 05.04.99   "TH" + time + "DTH"
     system date  <= 10.05.99   "TH" + date + time
     system date  <= 08.06.99   time + date + "40"
     system date  <= 29.08.99   date + time + "TH"
     system date  <= 20.12.99   "02117335498" + "DTH"
     system date  <= 31.12.99   time + "TH" + date
     system date  <= 05.04.00   "TH" + time + "DTH"
     system date  <= 10.05.00   "TH" + date + time
     system date  <= 08.06.00   time + date + "40"
     system date  <= 29.08.00   date + time + "TH"
     system date  <= 20.12.00   "02117335498" + "DTH"
     system date  <= 31.12.00   time + "TH" + date
     system date  >= 01.01.00   "TotenHosen" + time

The following text will be displayed on 02.01.2000:

     Heute ist der 02.01.2000. Sie haben den Makrovirus: Die Toten Hosen
     Makrovirus : Die Toten Hosen(DTH) aus Duesseldorf
     Der Virus wurd von M.N. aus Schwelm (BRD) am 08.06.1996 programmiert.
     Ich bin ein echter Hosen Fan.
     Das kennwort setzt sich zusammen aus Datum oder Zeit und den
     buchstaben (TH) oder (TotenHosen) oder (40) oder (DTH)
     Ha,ha,ha,ha,ha,ha,...

VARIANT:

Toten.A, Toten.B

There are two variants known at present.

[Analysis: perComp-Verlag Gmbh, F-Secure Support Germany]