Class Virus
Platform MSWord

Technical Details

This is a Word macro virus. It contains nine macros: Moss, Stealth,
AutoExec, AutoOpen, AutoClose, ToolsMacro, HerramMacro, FileTemplates,

The virus infects the global macros area (NORMAL.DOT) on opening an
infected document (AutoOpen) and writes itself to documents that are saved
(FileSave, FileSaveAs).

The virus sets new ScreenSaver Windows – it draws the text depending on the
Word local version:

Spain: Saludos de Moss ;o) DarkSide1
Others: Greetings from Moss ;o) DarkSide1

On closing a document depending on the random counter appends to the end of
document on of the texts:

Spain: :o) La flaquis de MOSS :o)
Others: :o) I’m so happy with MOSS :o)

Stealth: on entering Tools/Macro or File/Templates menus the virus displays
DialogBox in Spain or English, that DialogBox looks like original Word

Find out the statistics of the threats spreading in your region