Threat Description

Rapi

Details

Aliases: Rapi
Category: Malware
Type:
Platform: W32

Summary


For more information macro viruses, see the description of WordMacro/Concept.

Rapi is a Word macro virus consisting of several macros: AUTOOPEN, RPAE, RPFS, RPFSA, RPFO, RPTC, RPTM, RPAO, FILESAVE, RPFS, FILESAVEAS, FILEOPEN, TOOLSCUSTOMIZE, TOOLSMACRO.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

Detailed instructions for F-Secure security products are available in the documentation found in the Downloads section of our Home - Global site.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.



Technical Details


Rapi can generate different forms of itself, se all of the above macros are not necessarily always present in infected files.

Rapi hooks the Tools/Macro and Tools/Customize menus. If they are accessed, the virus spreads further and displays a messagebox like this:

Err@#*(C)          Fail on step 29296          OK  

Sometimes the virus also activates when File/Open menu is accessed. At this time it can display a messagebox like this:

@Rapi.Kom          Thank's for joining with us !          OK  

Sometimes the virus drop a text file called C:\BACALAH.TXT. This file contains this text:

Assalamualaikum . . ., maaf @Rapi.Kom . . .  

Rapi might be related to the CAP virus. Rapi has been reported to be in the wild internationally.





Description Details: Mikko Hypponen, F-Secure


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More