PayCheck

Classification

Malware

-

-

PayCheck, Bukit

Summary

For more information on Word macro viruses, see the description of WordMacro/Concept.

WordMacro/PayCheck is an encrypted macro virus. It contains seven macros: AutoExec, AutoOpen, FileSave, FileSaveAs, ToolsMacro, ShellOpen, FileOpen.

Removal

Automatic action

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

Find out more

Knowledge Base

Find the latest advice in our Community Knowledge Base.

User Guide

See the user guide for your product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

PayCheck actives on the 25th of any month. At this time it displays this dialog box:

 Selamat

Sekarang adalah tanggal 25, sudahkah anda mengambil gaji?

He..he..Selamat. Kalau bisa, lebih keras lagi kerjanya.

Bravo Bukit Asam !!!

Opening the File/SaveAs menu might display this dialog box:

 Non Critical Error

Internal error was occured in module UNIDRV.DLL

Your application may not be work normally.

Please contact Microsoft Product Support.

Opening the Tools/Macro menu might display this dialog box:

 Critical Error

Internal error was occured in module UNIDRV.DLL

Please contact Microsoft Product Support.

PayCheck was reported to be in the wild in fall 1997.

Date Created: -

Date Last Modified: -