Virus.MSWord.Carrier

Class Virus
Platform MSWord
Description

Technical Details


This virus contains three macros in one class “ThisDocument”:
Document_Close, Document_New, Document_Open, and two in module “Agent”:
AutoOpen, FileSaveAs.


The virus replicates on documents opening, closing or creating. The
replication routine used Import/Export functions via the C:NORMAL.BAS in
case of NORMAL.DOT and C:DOCUMENT.BAS file in case of documents.


The virus has the comment which is used to detect already infected files:


REM WRITTEN BY LORD ARZ

The virus sets the caption for all windows:

Infected by the Carrier virus (a trooper has already landed)