Class Virus
Platform MSWord

Technical Details

This is an encrypted macro virus. It contains four macros that have
different names in infected documents and NORMAL.DOT:

Documents NORMAL.DOT
AutoOpen YYYAO
XXXAO AutoOpen
XXXFS FileSave
PayLoad PayLoad

The virus infects the system on opening an infected document (AutoOpen) and
writes itself to other documents on opening and saving (AutoOpen, FileSave,

On each infection the virus copies the WINWORD.HLP file to TEMPLATESn.WRD
file, where ‘n’ in number of infection. In case of error the virus displays
one of MessageBoxes:

DúleOitè upozornini
!!! Tohle zpùsobil virus Bertik.1 !!!
!!! Made by virus Bertik.1 !!!

Find out the statistics of the threats spreading in your region