This macro virus infects MS Word documents and normal.dot template files. The virus itself is a macro named ‘AntiTheSecond’ and it seems that the author intended it to act as an antivirus against the macro virus TheSecond.
When an infected file or template is opened, the virus creates an export file named Anti.tmp in the MS Word start directory. The macro code is saved in this file. The virus then checks all MS Word documents which are currently open for the macro module of TheSecond virus. If this module is detected, the virus will cause a MessageBox to be displayed. The MessageBox contains the following text in Russian:
��������� ����� The Second � ��������� <��� �����> !
Translation: The Second has been detected in the document ‘name of file’!
It then deletes the contents of the virus module, without deleting the module TheSecond (which is a type of vaccine for files). If this is successfully completed, a MessageBox in Russian will be displayed on the screen:
�������� <��� �����> �������!
Translation: The document
If the document does not contain the virus TheSecond, Antisec will infect it by writing its code to the document from the file Anti.tmp. A MessageBox in Russian will then be displayed on the screen:
��������� �������� � �������� <��� �����> !!!
Translation: An antivirus has been added to the document
|Find out the statistics of the threats spreading in your region|