Kaspersky Threats

Class

Platform

Description

Technical Details

This is an encrypted macro virus containing five macros in infected
documents and ten macros in global macros area (NORMAL.DOT):



Documents           NORMAL.DOT

Ard01, AutoOpen     Ard01

Ard02               Ard02, FileSave, AutoClose

Ard03               Ard03, FileTemplates, ToolsMacro, ToolsCustomize

Ard04               Ard04, FileOpen

It infects the global macros area on opening an infected document
(AutoOpen) and copies itself to documents that are saved or closed
(FileSave, AutoClose). Before infecting the virus deletes all macros in
target. The virus stores the counter of infections in document’s variable
“ard01”. Depending on this counter the virus either prints to the status
line the text “O C H O Y * P K T B N I”, or displays the MessageBox:



BNI – PKT

(c) Ardi Sunardi – 1 9 9 7

Find out the statistics of the threats spreading in your region

Class	Virus
Platform	MSWord
Description	Technical Details This is an encrypted macro virus containing five macros in infected documents and ten macros in global macros area (NORMAL.DOT): Documents NORMAL.DOT Ard01, AutoOpen Ard01 Ard02 Ard02, FileSave, AutoClose Ard03 Ard03, FileTemplates, ToolsMacro, ToolsCustomize Ard04 Ard04, FileOpen It infects the global macros area on opening an infected document (AutoOpen) and copies itself to documents that are saved or closed (FileSave, AutoClose). Before infecting the virus deletes all macros in target. The virus stores the counter of infections in document’s variable “ard01”. Depending on this counter the virus either prints to the status line the text “O C H O Y * P K T B N I”, or displays the MessageBox: BNI – PKT (c) Ardi Sunardi – 1 9 9 7
	Find out the statistics of the threats spreading in your region

Virus.MSWord.Ochoy

Technical Details