The virus infects the global macros area (NORMAL.DOT) on opening an
infected document (AutoOpen) and writes itself to documents that are saved
with new name (FileSaveAs).
If the author of document is “Igor Daniloff”, the virus replaces the
AutoOpen and IDRWEBSCAN macros with harmless ones: new AutoOpen displays
IDRWEBSCAN is replaced with do-nothing macro.
|Find out the statistics of the threats spreading in your region|