Class Virus
Platform MSWord

Technical Details

It contains six macros in one module “GIPSY”: AutoOpen, Payload,
FileSaveAs, FilePrint, ViewVBCode, ToolsMacro. It infecting the global
macros area on opening an infected file. It infects other documents on
saving them with new names.

The Payload macro depending on the system random counter either displays
the Balloon:

The Gipsy Virus:
Copy me, I like to travel

For appends to the C:AUTOEXEC.BAT the commands that write to the
C:COMPUTER.V file the string “Help me I’m sick”:

@echo off
echo Help me I’m sick >>C:Computer.V

On December 24th the virus displays the Balloon:

BiologicBeast Virus:
Mary Christmas… don’t work at this day

Find out the statistics of the threats spreading in your region