Virus.MSWord.Dzt

Technical Details

This is an encrypted macro virus. The existing copy of infected document
contains only one macro FileSaveAs, but there are references to macros
FileSave and AutoOpen – the virus copies FileSave from NORMAL.DOT to
AutoOpen in documents, and AutoOpen from infected document to FileSave in
NORMAL.DOT. It seems that this copy of the virus is either corrupted, or
a “debug” version.

The virus inserts the text to the document’s comments area:

DZT’96

(c)9 April 1996 by Hikmat S/D0E94328

comp. dept. of HFT

Instrumentasi Elektronika

MIPA Terapan Fakultas MIPA

Universitas Padjadjaran

Bandung