World Cup 98
Analysis by and (c) Paolo Monti 
This macro virus was written in VBA (Visual Basic for Applications) for MS Word 8.0 (Office 97). It contains very dangerous payloads, and it displays message and dialog boxes concerning the World Cup Soccer Championship France 98. The VBA project of the virus contains one form named Pronostic and a module implementing 8 different macros: 

AutoExec: calls the macro Pronostique or WC98Payload (see below) 
AutoOpen: infects the global template and displays a messagebox 
FileSaveAs: infects new documents, saving them as templates, and displays a messagebox 
FileTemplates: displays a messagebox 
Pronostique: displays a dialog box where the user is forced to make a choice and implements a number of different payloads 
ToolsMacro: displays a messagebox 
ViewVBCode: shows the MS Word Assistant displaying a message 
WC98Payload: modifies the contents of active document 
The following instructions can be found at the beginning of all macros: 
Disable the possibility to interrupt macro execution 
Enable the execution of automatic macros 
Disable the antivirus protection built in Ms Word 
Disable the confirmation for the global template saving, usually asked before to exit from the program. 
The automatic macro AutoExec, executed at the startup of MS Word or when a general template is loaded, gets the current system date and time. If the day number is 12 or the seconds of the system clock are at 12, the AutoExec macro calls the macro Pronostique or the macro WC98Payload. The choice between the two macros is applied randomly. Each has a 50% probability to be called from AutoExec macro. 
The macro Pronostique displays a dialog box on the screen (the form Pronostic) by which the user is asked to choose among 9 differents teams partecipating to France 98 Championship. If the user chooses the same team selected randomly by the virus, a messagebox of congratulations is displayed on the screen, then the virus goes into an endless loop showing a message on the status bar. Otherwise, the virus applies a random selected payload. With a probability of 40% the virus appends the following lines to the file C:\AUTOEXEC.BAT: 

cls
Echo La coupe du monde 98 c'est gnial!!!!
Echo y|Format c: /u /v:WorldCup98
Echo o|Format c: /u /v:WorldCup98
27% of the time, the virus tries to delete all files in the directories C:\DOS and C:\WINDOWS\COMMAND and the files C:\MSDOS.SYS and C:\IO.SYS. 
In the remaining cases, the virus modifies the text of the active document and prints it. 

The macro WC98Payload creates in the active document a WordArt object, applies to it a number of rotation effects, and then erases it. 

Inside the project of the virus there are some messages in French: 

"VIVE LA COUPE DU MONDE 98!!!!"
"Vive le football!!!, Vive la Coupe du Monde 98!!!"


AVP detects/disinfects this virus since weekly update 980706

