Class Virus
Platform MSWord

Technical Details

This is an encrypted Word macro virus. It contains eight macros: AutoOpen,
UtilMacro, FerramMacro, ArquivoAbrir, ArquivoSalvar, UtilPersonalizar,
ArquivoSalvarComo, FerramPersonalizar.

The virus infects the global macros area (NORMAL.DOT) on opening an
infected document and writes itself to documents that are opened, saved or
saved with new name.

On May 19th the virus writes to the C:AUTOEXEC.BAT file the commands that
format the hard drive, the virus then displays the MessageBoxes:

Alevirus Labs 1997 11/21/97 Virus Extra Hipermercado
Extra = Mais Caro = Caixas sem educa o = Vacas HEHE
Hipermercado Extra 100% Caixas HIV Positivo!!! S>C>S

Find out the statistics of the threats spreading in your region