Virus.MSWord.Funfun

Class Virus
Platform MSWord
Description

Technical Details


This Word macro virus contains three macros with random selected names. To
access these macros the virus writes their names to the WIN.INI file in
section [Intl] in strings Info1, Info2, Info3 (in case of infected system –
NORMAL.DOT) or in internal document’s variables VirName, VirNameDoc,
VirNamePayload (in case of infected document).


To force Word to run its macros the virus assigns them to a random selected
key, i.e. the virus takes control only when that key is pressed.


There are several modifications of this virus. They display the
MessageBoxes:


“Funfun.a”: funfunfun
“Funfun.b”: DARKTREMOR
Dark Tremor
Polytest Virus ist Aktiv !!!

“Funfun.b” also drops multipartite virus “Smile”.