Virus.MSOffice.Corner

Class Virus
Platform MSOffice
Description

Technical Details

Corner is a multi-platform macro-virus, which infects both MS Word (DOC) and MS Project (MPP) files. The ability to infect these two office applications is based on two functions inside of the virus’ program code. One of them is automatically launched by MS Word and another by MS Project. These functions have different names in a NORMAL.DOT template, and infected Word documents and Project files.

The method of virus replicating and spreading is common to all macro-viruses created for MS Office applications: the virus takes control over the active document (or project) and adds to it the virus code by using standard features of the programming language VBA (Visual Basic for Applications).

The virus carries no destructive payload, and does not manifest itself in any other way.

The presence of the virus can be easily detected by the following comment string that the virus inserts into infected documents:

I never realized the lengths I’d have to go

All the darkest corners of a sense

I didn’t know

Just for one moment

hearing someone call

Looked beyond the day in hand

There’s nothing there at all

Project98/Word97-2k Closer