Virus.MSWord.Clara

Class Virus
Platform MSWord
Description

Technical Details


It is a polymorphic and stealth macro virus. It contains 8 macros in one
module called “Clara”: GetRandom, Effect, AutoOpen, AutoClose, ToolsMacro,
ViewVBCode, ToolsCustomize, FileTemplates.


It infects the global macros area on opening an infected document
(AutoOpen) and infects other documents on opening or saving (AutoOpen,
AutoClose).


The virus turns off the Word virus protection (the VirusProtection option).
It also disables the Tools/Macro, File/Templates, View/VBCode,
Tools/Customize menus (stealth). The virus’ polymorphic engine inserts random comments of random length into the virus code while
infecting .


On the 1st of any month the virus displays a “Balloon” and MessageBox:


WM97.Clara
Author: Foxz/NoMercyVirusTeam
WM97.Clara
Thanks friends

The virus also contains the comments:

Thanks to Pyro
Thanks Chasm