Virus.MSWord.Colombia

Class Virus
Platform MSWord
Description

Technical Details



It is a dangerous stealth macro virus. It contains seven macros in one
module “NewMacros”: AutoOpen, AutoClose, AutoNew, AutoExec, kill,
unprotect, engendrar.


It infects the global macros area on opening an infected document
(AutoOpen) and infects other documents on opening, creating and closing
(AutoOpen, AutoNew, AutoClose).


The virus turns off the Word virus protection (the VirusProtection option).
It also disables the Tools/Macro, View/Toolbars menus (stealth).


On each infecting (on automacros executing) it tries to format floppy disk
in the A: drive, prints to the status bar the text “Linea
Esquema a” and increases its counter by one. If this counter exceed 99, the
virus deletes all data on the C: drive by executing DOS command FORMAT.COM
in hidden DOS window.


On closing each document the virus displays to the status bar:



Publicidad para Colombia!!

The virus also contains the strings:



COLOMBIA
*** Salvado por Colombia ***
Se salv� el Diskette