Description |
Technical Details
This is encrypted virus, it contains the macros:
macros, FileNew, AutoExec, AutoOpen, FileExit,
FileSave, AutoClose, FileSaveAs, ToolsMacro
This virus infects the files while creating of new document (FileNew) and
while saving the document with new name (FileSaveAs).
On each 300th call to the file functions (FileNew, AutoOpen, FileExit,
FileSave, AutoClose, FileSaveAs and ToolsMacro) the virus alters the
section [colors] in the WIN.INI file, and sets the random selected colors
for Windows components. New colors appear after next Windows loading. The
virus keeps the trigger counter in the WIN.INI file in the [windows]
section:
[windows]
countersu= 234
The virus allows executing of Auto-macros (AutoOpen, AutoClose and so on),
it sets DisableAutoMacros to zero.
When the virus is active, it is impossible to activate Tools/Macro command.
To manual disinfection it is necessary to delete virus’ macros by using
Organizer (Tools/Customize, Word command, then draw Organizer out to
toolbar).
|