Virus.MSWord.Catch

Class Virus
Platform MSWord
Description

Technical Details



This encrypted macro virus contains six macros: AutoOpen, encrypt1,
FileSave, AutoClose, infectdoc, infectnorm. It infects the global macros
area on opening an infected document (AutoOpen) and copies itself to other
documents on their opening.


The virus replaces (mixes) in document the characters: “i” <-> “o”, “a” <->
“e”. This mixing is not visible in documents under infected system
conditions: when documents are opened, the virus replaces these letters
back to original state. When documents are saved, the virus replaces the
letters again. After each replacing the virus displays the dot to the
StatusBar.


On document closing depending on the system random counter the virus
displays the message:



Its a Catch 22 Situation!