Virus.MSWord.Greenpeace

Class Virus
Platform MSWord
Description

Technical Details


It is an encrypted Word macro virus, it contains seven macros:


Documents NORMAL.DOT
FlSvvs FileSaveAs
FlSvv FileSave
AtExc AutoExec
FlOpvvv FileOpen
AutoOpen ImpRovevvvv5
TlsMcr ToolsMacro
FileExit FClccc

The virus infects the global macros area (NORMAL.DOT) on opening an
infected document (AutoOpen) and writes itself to documents that are saved
with new name (FileSaveAs).


On 22 May 1998 when Word is starting, the virus displays the MessageBox:


Belik Natasha demands:
Stop pollution of an environment!!!!!
Protect ozonian layer!!!
Rescue Volga!!!
Pay the salary!!!!!
GreenPeace Virus

If the author of document is “Igor Daniloff”, the virus replaces the
AutoOpen and IDRWEBSCAN macros with harmless ones: new AutoOpen displays
the MessageBox:

In the WinWord6.0/7.0rus environment
the viruses are not distributed
DrWeb for WinWord

IDRWEBSCAN is replaced with do-nothing macro.


On entering the “Tools/Macro” menu the virus sets the document password
protection (password=”orhey”), and resets it after leaving “Tools/Macro”.