Skip to main content

Backhand

Classification

Category:

Malware

Aliases:

  • Backhand
  • Backhand.A

Summary

Backhand is a polymorphic Word 97 macro virus which payload simulates the Y2K-problem.

Removal

Technical Details

The virus replicates when an infected document is opened, closed or a new one is created.

Backhand.A first disables the build-in macro virus protection. After that it drops its code in a file "sysboot.bin" to the root of "C:" drive and uses it to infect global template and documents.

When infects documents the virus change some of its subroutine names with random ones.

The virus contains a few payloads. First of them activates when the day of the month is 13. Than it saves the active document with a random password and shows a message:

Your document has been corrupted because of a bug in Word! Call Microsoft Customer Support, they can help you. When you call, tell them this Bug-ID Code (don't forget it!)

If the day is also Friday then Backhand.A shows another message:

Have A Nice Day! It's Friday 13th! This is my lucky day, I hope it's yours too!

The last payload activates in year 2000 or later when Backhand.A change the system date to January 1st 1980.

Protect your devices from malware with F‑Secure Total

Protecting your devices from malicious software is essential for maintaining online security. F‑Secure Total makes this easy, helping you to secure your devices in a brilliantly simple way.

  • Award‑winning antivirus and malware protection

  • Online browsing, banking, and shopping protection

  • 24/7 online identity and data breach monitoring

  • Unlimited VPN service to safe­guard your privacy

  • Password manager with private data protection

Choose how many devices you want to protect to get started.

  • Free customer support

  • Cancel anytime

  • The trial does not obligate you to buy the product

After 30 days your subscription will renew automatically for one year at €69.99.

More Support

Community

Ask questions in our Community.

User guides

Check the user guide for instructions.

Contact Support

Chat with with or call an agent.

Submit a Sample

Submit a file or URL for analysis.