Class Virus
Platform MSWord

Technical Details

This virus contains one macro “autoOpen” in infected documents and two
macros “AutoOpen” and “Disaster” in global macro area. It infects the
global macro area (NORMAL.DOT) on opening an infected document and writes
its code to documents that are opened.

In documents the virus keeps the infection routine in area of document’s
variables. While infecting NORMAL.DOT the virus (“AutoOpen” macro) creates
the temporary file DISASTER.DEC, copies the document’s variables to there
and opens it. Newly created document contains a macro that infects the

While infecting a document the virus creates the same file DISASTER.DEC,
writes its code to there and inserts this document into document’s
variables. Then the virus copies the “AutoOpen” macro to this document.

Find out the statistics of the threats spreading in your region