Virus.MSWord.Cryptor

Class Virus
Platform MSWord
Description

Technical Details


This virus contains six macros in module “CryptorV97”: AutoOpen, AutoClose,
FileSaveAs, FileTemplates, ToolsMacro, ViewVBCode. It infects the global
macro area on opening an infected document and infects documents on saving
with new name.


The virus disables Word virus protection. On odd days the virus encrypts
the document contents. After infecting NORMAL.DOT or a
document it displays corresponding MessageBox:


Virus CryptorV97 Virus CryptorV97
Attention, modèle normal crypté ???? ZeMacroKiller98 vous remercie…

On entering the menu items “Tools/Templates and Add-Ins…”, “Tools/Macro”
and “Tools/Macro/Visual Basic Editor” the virus displays corresponding
MessageBox:

Microsoft Word
Espace pile insuffisant.
Microsoft Word
Fonction Sub non défini
Microsoft Word
Ce programme a réalisé une opération illégale et va être interrompu.