Class Virus
Platform MSWord

Technical Details

It is a polymorphic and stealth macro virus. It contains 8 macros in one
module called “Clara”: GetRandom, Effect, AutoOpen, AutoClose, ToolsMacro,
ViewVBCode, ToolsCustomize, FileTemplates.

It infects the global macros area on opening an infected document
(AutoOpen) and infects other documents on opening or saving (AutoOpen,

The virus turns off the Word virus protection (the VirusProtection option).
It also disables the Tools/Macro, File/Templates, View/VBCode,
Tools/Customize menus (stealth). The virus’ polymorphic engine inserts random comments of random length into the virus code while
infecting .

On the 1st of any month the virus displays a “Balloon” and MessageBox:

Author: Foxz/NoMercyVirusTeam
Thanks friends

The virus also contains the comments:

Thanks to Pyro
Thanks Chasm

Find out the statistics of the threats spreading in your region