Virus.MSWord.Inlay

Class Virus
Platform MSWord
Description

Technical Details


This is a German-specific Word macro virus. It contains eleven macros:
InnLib, FileOpen, FileSave, HilfeInfo, Innocence(AutoOpen), FileSaveAs,
ToolsMacro, DateiOffnen, DateiSpeichern, DateiSpeichernUnter, ExtrasMakro.


All infection routines are placed in InnLib macro, all other macros call
InnLib for necessary routines.


On opening a document the virus checks it for the macro viruses:


Atom Boom:De Buero:De Cap:De Clock:De Colors Concept Darkside Friday:De
Gangsterz Hot Imposter Lazy NF NomVir:De Friends:De Nuclear Nop:De Pheew
Spooky:De Stryx Target Tele Wazzu Zero:De Xenixos:De Outlaw

If any virus is found, the “Inlay” virus displays the MessageBox:

Innocence meldet:
Die Datei enth lt einen Makrovirus .
Identifiziert als:
KEINE PANIK:
Innocence wird nun versuchen, diesen Virus zu entfernen.
Ihr Dokument wird nicht besch digt.

The “Inlay” virus calculates the number of detected viruses in the WIN.INI
file in the section “[Intl]” in string “Killed”. In string ” “Inlay” it
keeps the month of latest infection. The virus also creates the INLAY file
which adds to the NORMAL.DOT and registers in the “pfad” string.


On entering the Tools/Macro menu the virus saves “backup” of the current
document to the NORMAL.DOC, removes all its macros and loads original not
infected file