It is polymorphic and stealth macro virus. It contains six macros in the
one module “Chaos”: AutoOpen, FileNewDefault, FileNew, ToolsMacro,
FileTemplates, ViewVBCode, FormatStyle.
The virus infects the system on opening an infected document. Infection
does not modify the NROMAL.DOT file – the virus saves infected file in
Startup path and in C:WINDOWSSHELLNEWWINWORD8.DOC directory. Documents
get infection only on creating.
The virus polymorphic engine inserts at random places into virus code
comments: “Rem ” or “‘”. The virus disables macro code viewing (stealth)
by dummy macros ToolsMacro, FileTemplates, ViewVBCode.
The virus contains the comments:
W97M/Chaos by Lord Natas
2/12/98 (its about time I released it!)
“Without the threat of death there’s no reason to live at all”