Virus.MSWord.Lunar

Home Threats Virus Virus.MSWord.Lunar

Class	Virus
Platform	MSWord
Description	Technical Details This is an encrypted macro virus. It contains seven macros: autoexec, autoopen, filesave, autoclose, filesaveas, toolsmacro, filetemplates. The virus infects the global macros area on opening (AutoOpen) or closing (AutoClose) an infected document. It infects the documents that are saved (FileSave) or saved with new name (FileSaveAs). The virus creates the LUNAR.INI file and writes the text to there: [virus] lunar= author=Hyperlock This is a stealth-virus – it hooks File/Templates and Tools/Macro, on entering these menus the virus displays the MessageBox: Microsoft Word Not enough memory to perform this operation The virus contains the commented text strings: WM.Lunar virus AutoExec macro

Technical Details