Virus.MSWord.Mark

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted Chinese Word macro virus. It contains five macros: A,
B, AutoExec, AutoOpen, ToolsMacro (stealth). The virus replicates itself
when documents are opened (AutoOpen).


Depending on the random counter the virus creates a new document and writes
to there a text in Chinese. It also creates the C:X.TXT file and writes to
there “0” or “1” also depending on the random counter. On next Word loading
(AutoExec), if there is “1” in that file, the virus appends to the
C:AUTOEXEC.BAT file the commands that formats the hard drive:


format c:/u/V:MARK>nul