Technical Details
This is an encrypted macro virus. It contains two macros: AutoOpen, FileOpen.
It infects the global macro area on opening an infected document (AutoOpen)
and writes itself to other documents also on opening (FileOpen).
It creates a new section [Compatibility] in the WINWORD6.INI file and writes
the string “MSWORD number” to there, where “number” is the virus generation.
When “number” reaches 500, the virus displays the MessageBox ” 500″.
The virus contains the text “LordSatan” in its comments.
|