Virus.MSWord.Ochoy

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted macro virus containing five macros in infected
documents and ten macros in global macros area (NORMAL.DOT):


Documents NORMAL.DOT
Ard01, AutoOpen Ard01
Ard02 Ard02, FileSave, AutoClose
Ard03 Ard03, FileTemplates, ToolsMacro, ToolsCustomize
Ard04 Ard04, FileOpen

It infects the global macros area on opening an infected document
(AutoOpen) and copies itself to documents that are saved or closed
(FileSave, AutoClose). Before infecting the virus deletes all macros in
target. The virus stores the counter of infections in document’s variable
“ard01”. Depending on this counter the virus either prints to the status
line the text “O C H O Y * P K T B N I”, or displays the MessageBox:

BNI – PKT
(c) Ardi Sunardi – 1 9 9 7