Virus.MSWord.Apparition

Class Virus
Platform MSWord
Description

Technical Details


This is quite a primitive virus. It is dropped by Windows EXE virus
“Win.Apparition”. It contains three macros: WWUpdated, AutoOp (AutoOpen),
FileOpen.


WWUpdated is the virus ID-macro. The virus detects its presence in the
system by using this name. Macro AutoOp (AutoOpen in NORMAL.DOT) installs
the virus macros into the system on opening an infected file. Macro
FileOpen infects files on opening.


The virus contains the text strings, but does not use them in any way:


Presence of AVP for winword
AVP for Winword is a nice tutorial
(C) 2 Rats Soft.
this macro loaded in normal template as FileOpen
AVPcopyright$ AVP for WinWord v1.0
sQuestion$ Would you like to