This is the first known macro virus infecting MS PowerPoint presentation
files. As well as other viruses infecting MS Office applications this is
written in Visual Basic for Applications (VBA) language, and for spreading
it uses Basic instructions and MS PowerPoint features.
The virus contains one macro that has event-function “UserForm_Terminate”,
this function is activated each time when UserForm is closed. This is the
main virus function and it contains the virus infection routine.
When activated the virus infection routine searches for *.PPT files in the
“C:My Documents” directory and subdirectory tree, opens files and copies
its macro code to there.
Because of PowerPoint internal structure the virus is able to get control
only in case any UserForm exists in target file. The virus checks files for
UserForm presence and infects only such presentation. Otherwise the virus
skips files and leaves them not infected.
The virus does not manifest itself in any way. It contains the comments,
the first line is also used by the virus as the identification text to
prevent duplicate infection:
PPT.Attach v0.1 /1nternal