Virus.MSWord.Color

Class Virus
Platform MSWord
Description

Technical Details


This is encrypted virus, it contains the macros:


macros, FileNew, AutoExec, AutoOpen, FileExit,
FileSave, AutoClose, FileSaveAs, ToolsMacro

This virus infects the files while creating of new document (FileNew) and
while saving the document with new name (FileSaveAs).


On each 300th call to the file functions (FileNew, AutoOpen, FileExit,
FileSave, AutoClose, FileSaveAs and ToolsMacro) the virus alters the
section [colors] in the WIN.INI file, and sets the random selected colors
for Windows components. New colors appear after next Windows loading. The
virus keeps the trigger counter in the WIN.INI file in the [windows]
section:


[windows]
countersu= 234

The virus allows executing of Auto-macros (AutoOpen, AutoClose and so on),
it sets DisableAutoMacros to zero.


When the virus is active, it is impossible to activate Tools/Macro command.
To manual disinfection it is necessary to delete virus’ macros by using
Organizer (Tools/Customize, Word command, then draw Organizer out to
toolbar).