Virus.MSWord.Bismark

Class Virus
Platform MSWord
Description

Technical Details


This virus contains seven macros: AutoOpen, BisMark, ToolsMacro( ѽ ),
ToolsCustomize, ViewVBcode, FileSave, and FileClose.


The virus infects upon the opening or saving of documents (AutoOpen, FileClose). Upon
opening a file, the virus turns off the VirusProtection options.


Upon saving a document, the virus erases files belonging to well known
anti-viruses:


c:program filesnorton antivirusVirscan2.dat
c:vdoc*.*
c:f-prot*.*
c:program filesantiviral toolkit pro*.*

Upon entering the menu item Tools/Macro, the virus installs the password
“Bismark” on the document, and outputs the Balloon:

Word Macro Virus BisMark1
You Should Have Left Me Alone, I Was Not Hurting Anything. Now I’am Mad!

After this, the virus shuts down Windows. On Friday at 12:00, the virus
inserts the autocorrect entries “the” on value “Word Macro Virus BisMark1,
Written By Talon”.