Virus.MSWord.Incarnate

Class Virus
Platform MSWord
Description

Technical Details


This is the Word macro virus. It contains seven macros: AutoExec, AutoExit,
FileSave, AutoClose, FileClose, FileSaveAs, ToolsMacro.


The virus infects the global macros area (NORMAL.DOT) on closing an
infected document (AutoClose, FileClose) and writes itself to documents
that are saved (FileSave) or saved with new name (FileSaveAs). The virus
contains a bug and while infecting by FileClose copies the same macros
FileSaveAs to new macros FileSave and FileSaveAs. As a result the virus
discloses itself on saving a document – instead of saving Word displays the
FileSaveAs dialog box.


While closing a document the virus also appends the its end the text:


To end with, I would like to say…
To defy me is to bring upon my wrath…
For I am CyberDarkness
I am Darkness Incarnate…
I will Not be Denied!!!
CyberDarkness

On leaving Word the virus writes new Desktop color set to the WIN.INI file.