Virus.MSWord.Mamm

Class Virus
Platform MSWord
Description

Technical Details

This stealth macro virus contains one empty module “MAMM” and eighteen
procedures in module “aviro”: AstMaster, Mhapus, Mcopy, Action, FileOpen,
AutoOpen, ViewVbCode, AutoExec, AutoExit, ToolsMacro, FileTemplates,
FormatStyle, Refresh, AutoClose, FileExit, ToolsOptions, WBT, WBF.

It infects the global macros area on opening an infected document. The
virus also creates in MS Word startup folder two infected files:


MAMM.dot
MAMM.src

On each document opening the virus checks all already opened documents and
infects them. It also infects documents on their closing.

Starting from 15 May 1998 the virus activates its payload procedure. It
sets its call on time 45 minutes after document opening. Payload procedure
only displays the message box:


To: MAMM
If you delete this, you have no heart

The virus hooks menus “ToolsMacroMacros…” and “ToolsMacroVisual Basic
Editor”. On click of these menus the virus displays “Record Macro” dialog
box with macro description:


‘If you delete this, you have no heart’