Virus.MSWord.Bishkek

Class Virus
Platform MSWord
Description

Technical Details


This virus contains four original macros that are copied with different
names while infecting documents or NORMAL.DOT:


Documents NORMAL.DOT
AOSample, AutoOpen AOSample
FSSample FSSample, FileSaveAs
FOSample FOSample, FileOpen
RVSample RemoveVaccine

The virus infects the global macros area on opening an infected document
(AutoOpen). It infects documents that are opened (FileOpen) or saving with
new name (FileSaveAs).


The virus searches and deletes macros that belong to the “Concept” macro virus.
While saving templates with a new name the virus displays a DialogBox. This
dialog contains items to select file format to save document (DOT, DOC,
TXT). On pressing the “About” button the virus displays the text:


Read this information to settle your issue
It is possible to select one of the next Items:
1. “Document Templates(* .dot)”
2. “Word Documents(* .doc)”
3. “Text Files(* .txt)”
Selecting the first Item does not convert your Document to another format
and saves all Macroses there.
Consequently, this Document will keep your own Samles and also will
eradicate the Word infection in the future. That ability to remove such
infection will be spreaded to other computers. Template’s documents alone
are capable to do it!
Selecting the next Items (2,3..) will convert your Template’s Document to
the Simple Format as *.doc or *.txt
In this Case, it is necessary to remember, that any Samples and Macroses
kept by Template’s Document will have been lost!
To remove this Word Vaccine it is necessary to run RemoveVaccine macros
from the ToolsMacro… menu!
RM of the WB, Bishkek, Fax:007(3312)620156, tel. 620157