This macro virus infects the MS PowerPoint presentations. The virus
contains one macro “actionhook” in the “ShapeMaster” module. The virus is
activated on the MouseClick on the infected form, it then runs its
installation routine and infects the PowerPoint installed on the computer.
The virus then infects other presentations only when they are created.
While affecting the system the virus copies its code to the “Blank
Presentation.pot” file in the Templates directory. This file is used as
base while creating a new presentation. As a result the virus code is
automatically copied to newly created presentations.
Depending on the system random counter the virus shows the previous slide
of the infected presentation. Also depending on the random counter the
virus displays the MessageBox:
PPT.ShapeMaster v0.1 /1nternal