Virus.MSWord.Killluf

Class Virus
Platform MSWord
Description

Technical Details


The viruses of this family contain three macros: AutoClose, VisioOpen,
VisioClose. They spread on closing document (AutoClose). During infection
they do not copy themselves to documents, but move. After copying they
delete themselves in original document. They keep the name of current
document in the WINWORD6.INI file in the [Microsoft Word] section with the name
LUF01.


Starting from January 1st 1999 they erase the files on all drives in all
directories: *.DOC, *.PPT, *.XL?, *.MPP, *.WPS, *.MDB. Then the MessageBox
is displayed


HAPPY NEW YEAR FOLKS!