Class Virus
Platform MSWord

Technical Details

This is an encrypted macro virus. It contains seven macros: autoexec,
autoopen, filesave, autoclose, filesaveas, toolsmacro, filetemplates.

The virus infects the global macros area on opening (AutoOpen) or closing
(AutoClose) an infected document. It infects the documents that are saved
(FileSave) or saved with new name (FileSaveAs).

The virus creates the LUNAR.INI file and writes the text to there:


This is a stealth-virus – it hooks File/Templates and Tools/Macro, on
entering these menus the virus displays the MessageBox:

Microsoft Word
Not enough memory to perform this operation

The virus contains the commented text strings:

WM.Lunar virus
AutoExec macro

Find out the statistics of the threats spreading in your region