Virus.MSWord.Bertik

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted macro virus. It contains four macros that have
different names in infected documents and NORMAL.DOT:


Documents NORMAL.DOT
AutoOpen YYYAO
XXXAO AutoOpen
XXXFSA FileSaveAs
XXXFS FileSave
PayLoad PayLoad

The virus infects the system on opening an infected document (AutoOpen) and
writes itself to other documents on opening and saving (AutoOpen, FileSave,
FileSaveAs).


On each infection the virus copies the WINWORD.HLP file to TEMPLATESn.WRD
file, where ‘n’ in number of infection. In case of error the virus displays
one of MessageBoxes:


DúleOitè upozornini
!!! Tohle zpùsobil virus Bertik.1 !!!
!!! Made by virus Bertik.1 !!!