Virus.MSWord.Hilight

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted macro virus. It contains two macros that have
different names in documents and NORMAL.DOT:


Documents NORMAL.DOT
AutoOpen AutoExec
PrezentIt FileSaveAs

The virus infects the system on AutoOpen call and writes itself to
documents on FileSaveAs call. The virus creates a counter in system
profiles (WIN.INI) file:

[WINDOWS]
Count=0

The virus increases this counter on each AutoExec, and when the counter reaches
10, the virus changes the Windows palette colors.