WordMacro/CAP
is one of the most common viruses in the world.CAP is a complex Word macro virus. It consists of several encrypted macros: CAP, AutoExec, AutoOpen, FileSave, FileSaveAs, FileTemplates, ToolsMacro, FileClose, FileOpen and AutoClose.
The virus contains the following message:
C.A.P: Un virus social.. y ahora digital.. "j4cKy Qw3rTy" (jqw3rty@hotmail.com). Venezuela, Maracay, Dic 1996. P.D. Que haces gochito ? Nunca seras Simon Bolivar.. Bolsa !When infecting Word, CAP modifies up to five alreadyexisting menus, redirecting them to the virus code. This creates some problems, as the names of the modified entries are different in different Word installations and different language versions of Word.
One effect of CAP is that all documents are saved in the Word DOC format, regardless of the format you choose. So, for example, if a document is saved as an RTF file, the extension of the document will become RTF but internally the file is still a DOC and does still contain the virus. Normal RTF files do not contain macros at all and are unable to spread macro viruses.
When CAP infects documents, it deletes all existing macros from them.
Otherwise CAP does not do anything destructive. However, it does remove
the Tools/Macro and Tools/Customize menus and disables File/Templates menu
in order to protect itself.
