Virus.MSWord.Mamm

Technical Details

This stealth macro virus contains one empty module “MAMM” and eighteen
procedures in module “aviro”: AstMaster, Mhapus, Mcopy, Action, FileOpen,
AutoOpen, ViewVbCode, AutoExec, AutoExit, ToolsMacro, FileTemplates,
FormatStyle, Refresh, AutoClose, FileExit, ToolsOptions, WBT, WBF.

It infects the global macros area on opening an infected document. The
virus also creates in MS Word startup folder two infected files:

MAMM.dot

MAMM.src

On each document opening the virus checks all already opened documents and
infects them. It also infects documents on their closing.

Starting from 15 May 1998 the virus activates its payload procedure. It
sets its call on time 45 minutes after document opening. Payload procedure
only displays the message box:

To: MAMM

If you delete this, you have no heart

The virus hooks menus “ToolsMacroMacros…” and “ToolsMacroVisual Basic
Editor”. On click of these menus the virus displays “Record Macro” dialog
box with macro description:

‘If you delete this, you have no heart’