Virus.MSWord.Demon

Class Virus
Platform MSWord
Description

Technical Details


It contains three macros, two of them have random selected names, the last
one is AutoOpen in documents and AutoClose in NORMAL.DOT. To get these
random names on infection the virus saves them in document’s variables or
in WIN.INI file.


To prevent duplicate infections the virus uses the description of the AutoClose
macros. In infected files this description contains the string “Protects
your computer”. To detect itself the virus also creates the section “[I]”
in WIN.INI file.


Starting from May and till December the virus removes itself from the
system. It there is the text “Dark Master calling” in current document, and
it is selected, the virus displays the MessageBox:


Microsoft WinWord DEMON
WINWORD HIDDEN DEMON
is happy to see his MASTER!!!
GREAT DAY !!!
This file is infected as # <¡«¼Ñ »« «½Ñ¡¿ >