Virus.MSWord.Dzt

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted macro virus. The existing copy of infected document
contains only one macro FileSaveAs, but there are references to macros
FileSave and AutoOpen – the virus copies FileSave from NORMAL.DOT to
AutoOpen in documents, and AutoOpen from infected document to FileSave in
NORMAL.DOT. It seems that this copy of the virus is either corrupted, or
a “debug” version.


The virus inserts the text to the document’s comments area:


DZT’96
(c)9 April 1996 by Hikmat S/D0E94328
comp. dept. of HFT
Instrumentasi Elektronika
MIPA Terapan Fakultas MIPA
Universitas Padjadjaran
Bandung