Virus.MSWord.Date

Class Virus
Platform MSWord
Description

Technical Details


This macro virus was written in Italy. It contains the automatic macro
AutoOpen, by which it infects documents and the NORMAL.DOT template. The
macro AutoOpen is encrypted (i.e. it is not directly modifiable). Besides
the Main subroutine – inside macros it is present on default – the virus
contains two other subroutines:


Infezione (Infection)
Effetti (Payload)

Before running the “Infezione” and “Effetti” subroutines, Word.Macro.Date
checks the system date. If the year is < 1997 and month is < 6, the virus runs the infection routines, otherwise it aborts its operations.


Word.Macro.Date seems to work correctly also on the English version of
Word.


The “Effetti” routine tries to delete the macro AutoClose from templates
(disinfects “Divina” macro virus?).