This is an encrypted Word macro virus containing only one macro –
LoneRaider. This is not an auto macro, and it can be executed only by user’s
request, i.e. if it is run by Tools/Macro/Run menu item.
When the virus takes control, it replicates itself. While replicating the
virus does not use any macro copy commands, but creates and runs new macro
named “LoneRaiderTwo” and uses this macro to copy itself to system global
macros or a document.
To do that the virus calls the Tools/Macro/Edit menu item to edit new
“LoneRaiderTwo” macro, inserts to there WordBasic commands including
MakroKopieren (MacroCopy), then it runs this macro and deletes it by
Tools/Macro/Run and Tools/Macro/Delete menu items. When executed,
the “LoneRiderTwo” macro copies the original “LoneRaider” macro to the destination
document or global macros area.
On January 1st the virus creates a new template and inserts the strings to
Enjoy the first F/WIN Killer!