Virus.MSWord.Lunar

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted macro virus. It contains seven macros: autoexec,
autoopen, filesave, autoclose, filesaveas, toolsmacro, filetemplates.

The virus infects the global macros area on opening (AutoOpen) or closing
(AutoClose) an infected document. It infects the documents that are saved
(FileSave) or saved with new name (FileSaveAs).


The virus creates the LUNAR.INI file and writes the text to there:


[virus]
lunar=
author=Hyperlock

This is a stealth-virus – it hooks File/Templates and Tools/Macro, on
entering these menus the virus displays the MessageBox:

Microsoft Word
Not enough memory to perform this operation

The virus contains the commented text strings:

WM.Lunar virus
AutoExec macro