Kaspersky Threats

Class

Platform

Description

Technical Details

This is an encrypted macro virus. It contains four macros that have
different names in infected documents and NORMAL.DOT:



Documents  NORMAL.DOT

AutoOpen   YYYAO

XXXAO      AutoOpen

XXXFSA     FileSaveAs

XXXFS      FileSave

PayLoad    PayLoad

The virus infects the system on opening an infected document (AutoOpen) and
writes itself to other documents on opening and saving (AutoOpen, FileSave,
FileSaveAs).

On each infection the virus copies the WINWORD.HLP file to TEMPLATESn.WRD
file, where ‘n’ in number of infection. In case of error the virus displays
one of MessageBoxes:



DúleOitè upozornini

!!! Tohle zpùsobil virus Bertik.1 !!!

!!! Made by virus Bertik.1 !!!

Find out the statistics of the threats spreading in your region

Class	Virus
Platform	MSWord
Description	Technical Details This is an encrypted macro virus. It contains four macros that have different names in infected documents and NORMAL.DOT: Documents NORMAL.DOT AutoOpen YYYAO XXXAO AutoOpen XXXFSA FileSaveAs XXXFS FileSave PayLoad PayLoad The virus infects the system on opening an infected document (AutoOpen) and writes itself to other documents on opening and saving (AutoOpen, FileSave, FileSaveAs). On each infection the virus copies the WINWORD.HLP file to TEMPLATESn.WRD file, where ‘n’ in number of infection. In case of error the virus displays one of MessageBoxes: DúleOitè upozornini !!! Tohle zpùsobil virus Bertik.1 !!! !!! Made by virus Bertik.1 !!!
	Find out the statistics of the threats spreading in your region

Virus.MSWord.Bertik

Technical Details