Class Virus
Platform MSWord

Technical Details

This encrypted macro virus contains six macros: AutoOpen, encrypt1,
FileSave, AutoClose, infectdoc, infectnorm. It infects the global macros
area on opening an infected document (AutoOpen) and copies itself to other
documents on their opening.

The virus replaces (mixes) in document the characters: “i” <-> “o”, “a” <->
“e”. This mixing is not visible in documents under infected system
conditions: when documents are opened, the virus replaces these letters
back to original state. When documents are saved, the virus replaces the
letters again. After each replacing the virus displays the dot to the

On document closing depending on the system random counter the virus
displays the message:

Its a Catch 22 Situation!

Find out the statistics of the threats spreading in your region