Virus.MSWord.KillProt

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted macro virus. It contains four macros: AutoOpen,
FileSaveAs, FileOpen, ToolsMacro. It infects global macros area on AutoOpen
and ToolsMacro, documents get infection on FileOpen and FileSaveAs.


The virus creates the “Count=” parameter in “Infector” section in system
profiles and increases its value on each FileSaveAs call. On every tenth
saving a document with new name the virus sets the password for that
document:


WhatTheHell

On any other saving the virus converts document to template. On each
AutoOpen the virus deletes the macros AutoExit, InstVer, ShellOpen
(ScanProt-specific macros).