Virus.MSWord.Dig

Class Virus
Platform MSWord
Description

Technical Details

Dig is a stealth macro virus. It contains the following macros:

AutoOpen, AutoExec, FileSave, FileSaveAs, ToolsOptions, ToolsMacro, ViewVBCode.

When an infected file is opened the virus disables the VirusProtection and DisableAutoMacros security options. The virus infects documents while they are opened, closed, or saved with alternative names (AutoOpen, FileClose, FileSaveAs).

The virus hides its body while Tools/Macro or File/Templates menu items are invoked.

If the user tries to view the macros source code, the virus calls the FatalAppExit system function and displays the following message:

“?R?�’� WinWord ?�? ‘ � � ‘�-�� Rɳ??� ?�� ?�R?? VBA! Code : dd!Actor”

If the current hour and minute values match (for example, 8:08) while the virus is infecting a document, it creates a new auto-format rule that replaces “,” with “, ?’�-,” and shows a message box with the following text:

Copyright c 1999 by dd!Actor.
All rights reserved.