Virus.MSWord.Nostradamus

Detect Date 01/11/2002
Class Virus
Platform MSWord
Description

Technical Details


This Italian Word macro virus contains three macros: MacroOnFile,
StrumMacro, AutoOpen. The virus infects the global macros area (NORMAL.DOT)
on opening an infected document (AutoOpen) and writes itself to documents
that are saved (MacroOnFile – in NORMAL.DOT this macro has the name
FileSalva).


This is the stealth virus – it draws its own Dialog (in Italian) on
entering Tools/Macro menu.


On 31st the virus displays the MessageBox:


NOSTRADAMUS Virus
Barbaro impero dal terzo sarai soggiogato,
Gran parte d’individui della sua origine far perire:
Per decesso senile avverr la sua fine, il quarto colpir
Per timore che il sangue con il sangue morte ne derivi.
Centuria 3., LIX