Virus.MSWord.Mercado

Technical Details

This is an encrypted Word macro virus. It contains eight macros: AutoOpen,
UtilMacro, FerramMacro, ArquivoAbrir, ArquivoSalvar, UtilPersonalizar,
ArquivoSalvarComo, FerramPersonalizar.

The virus infects the global macros area (NORMAL.DOT) on opening an
infected document and writes itself to documents that are opened, saved or
saved with new name.

On May 19th the virus writes to the C:AUTOEXEC.BAT file the commands that
format the hard drive, the virus then displays the MessageBoxes:

Alevirus Labs 1997 11/21/97 Virus Extra Hipermercado

Extra = Mais Caro = Caixas sem educa  o = Vacas HEHE

Hipermercado Extra 100% Caixas HIV Positivo!!! S>C>S