Class Virus
Platform MSWord

Technical Details

This is an encrypted macro virus. It contains four macros: AutoOpen,
FileSaveAs, FileOpen, ToolsMacro. It infects global macros area on AutoOpen
and ToolsMacro, documents get infection on FileOpen and FileSaveAs.

The virus creates the “Count=” parameter in “Infector” section in system
profiles and increases its value on each FileSaveAs call. On every tenth
saving a document with new name the virus sets the password for that


On any other saving the virus converts document to template. On each
AutoOpen the virus deletes the macros AutoExit, InstVer, ShellOpen
(ScanProt-specific macros).

Find out the statistics of the threats spreading in your region