Class Virus
Platform MSWord

Technical Details

This is an encrypted Chinese Word macro virus. It contains five macros: A,
B, AutoExec, AutoOpen, ToolsMacro (stealth). The virus replicates itself
when documents are opened (AutoOpen).

Depending on the random counter the virus creates a new document and writes
to there a text in Chinese. It also creates the C:X.TXT file and writes to
there “0” or “1” also depending on the random counter. On next Word loading
(AutoExec), if there is “1” in that file, the virus appends to the
C:AUTOEXEC.BAT file the commands that formats the hard drive:

format c:/u/V:MARK>nul

Find out the statistics of the threats spreading in your region