Virus.MSWord.Friday

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted German-specific macro virus. It contains three macros:


Documents NORMAL.DOT
AutoOpen NOPO
NOPS DateiSpeichern
NOPSA DateiSpeichernUnter

It infects the global macros area on opening an infected document
(AutoOpen) and copies itself to documents that are saved (DateiSpeichern,
DateiSpeichernUnter – FileSave, FileSaveAs).


Depending on the system date and time the virus sets a password for current
document or/and exits Windows. On Friday13th it sets the password
“Friday13”.