Class Virus
Platform MSWord

Technical Details

This Word macro virus contains three macros with random selected names. To
access these macros the virus writes their names to the WIN.INI file in
section [Intl] in strings Info1, Info2, Info3 (in case of infected system –
NORMAL.DOT) or in internal document’s variables VirName, VirNameDoc,
VirNamePayload (in case of infected document).

To force Word to run its macros the virus assigns them to a random selected
key, i.e. the virus takes control only when that key is pressed.

There are several modifications of this virus. They display the

“Funfun.a”: funfunfun
“Funfun.b”: DARKTREMOR
Dark Tremor
Polytest Virus ist Aktiv !!!

“Funfun.b” also drops multipartite virus “Smile”.

Find out the statistics of the threats spreading in your region