Virus.MSWord.Imposter

Class Virus
Platform MSWord
Description

Technical Details


This is a plagiarism from “Word.Macro.Concept” and “Word.Macro.DMV”. It
contains two macros:


in infected document: AutoClose, DMV
in infected NORMAL.DOT: FileSaveAs, DMV

While infecting the system the virus receives the control in AutoClose
document, renames DMV macro to FileSaveAs, then renames AutoClose to DMV.
While infecting the files (FileSaveAs) the virus renames these macros back
DMV -> AutoClose, FileSaveAs -> DMV.


While infecting the documents the virus displays the MessageBox:


DMV

One of the strings in the virus body looks like follows:

just to prove another point