Class Virus
Platform MSWord

Technical Details

This is a plagiarism from “Word.Macro.Concept” and “Word.Macro.DMV”. It
contains two macros:

in infected document: AutoClose, DMV
in infected NORMAL.DOT: FileSaveAs, DMV

While infecting the system the virus receives the control in AutoClose
document, renames DMV macro to FileSaveAs, then renames AutoClose to DMV.
While infecting the files (FileSaveAs) the virus renames these macros back
DMV -> AutoClose, FileSaveAs -> DMV.

While infecting the documents the virus displays the MessageBox:


One of the strings in the virus body looks like follows:

just to prove another point

Find out the statistics of the threats spreading in your region