Virus.MSWord.Gipsy

Class Virus
Platform MSWord
Description

Technical Details



It contains six macros in one module “GIPSY”: AutoOpen, Payload,
FileSaveAs, FilePrint, ViewVBCode, ToolsMacro. It infecting the global
macros area on opening an infected file. It infects other documents on
saving them with new names.


The Payload macro depending on the system random counter either displays
the Balloon:



The Gipsy Virus:
Copy me, I like to travel


For appends to the C:AUTOEXEC.BAT the commands that write to the
C:COMPUTER.V file the string “Help me I’m sick”:



@echo off
echo Help me I’m sick >>C:Computer.V


On December 24th the virus displays the Balloon:



BiologicBeast Virus:
Mary Christmas… don’t work at this day