Virus.MSWord.Lafs

Technical Details

The virus code contains six macros in one module: AutoOpen, AutoClose,
ToolMacro, ViewVBCode, FileTemplates, exec. In templates module name is
“lafs”, in documents – “dd”.

The virus replicates on opening and closing documents. While infecting it
disables VirusProtection option. On closing documents the virus displays
its own FileSaveAs dialog.

On June’14 the virus displays the assistant balloon:

Happy Birthday

Selamat Ulang Tahun sayang semoga panjang umur dan tuhan menyertaimu.

Love at First Sight

Patas AC 19

6 November 1997