Class Virus
Platform MSWord

Technical Details

This is not a dangerous encrypted Word macro virus. It is related to the
“MDMA” virus. It contains four macros: AutoClose, DarkSide1,
HerramMacro, ToolsMacro. It infects the documents and the global macros
area on AutoClose call.

The virus disables Tools/Macro menu (Herram/Macro in Spanish). It creates
on disks the DARKSIDE.1 files and writes the texts to there:

ATENCION: esta computadora ha sido infectada!. DarkSide1 sin una
computadora es como Billy The Kid sin un revolver! ! . . . Virus DarkSide1
creado en la ciudad de Lima en enero de 1997 -=] DarkSide1 Is a peruvian
virus writer [=-

The virus also contains the REMarked comments:

DarkSide1 is in the wild!!! 🙂
DarkSide1’s E-Mail:
DarkSide1’s live in Peru!!


This encrypted virus contains three macros: AutoClose, DarkSide1B,
HerramMacro. It creates the DARKSIDE.NEW file in current directory on C:
drive and writes the text to there:

DarkSide1 is Back!!
The name of this macrovirus is DarkSide1.B
Caro’s name Dark.A ?! Caro Sucks!! 🙂
And remember… DarkSide1 whitout a computer is like…
Billy the Kid without a gun!! 🙂
WM.DarkSide1.B] by DarkSide1 in Lima Peru 1997

The HerramMacro macro contain the texts:

it’s only a clean macro 🙂 very easy !!
DarkSide1 is Cool Macro Virus Writer 🙂
I like the macrovirii scene…rocks!! 🙂

Find out the statistics of the threats spreading in your region