Class Virus
Platform MSWord

Technical Details

This is an encrypted macro virus. The existing copy of infected document
contains only one macro FileSaveAs, but there are references to macros
FileSave and AutoOpen – the virus copies FileSave from NORMAL.DOT to
AutoOpen in documents, and AutoOpen from infected document to FileSave in
NORMAL.DOT. It seems that this copy of the virus is either corrupted, or
a “debug” version.

The virus inserts the text to the document’s comments area:

(c)9 April 1996 by Hikmat S/D0E94328
comp. dept. of HFT
Instrumentasi Elektronika
MIPA Terapan Fakultas MIPA
Universitas Padjadjaran

Find out the statistics of the threats spreading in your region