Virus.MSWord.Osm

Technical Details

This is a stealth companion macro virus. It contains two modules
“NewMacros” and “dlgMyMacs”. It does not infect the global macros area and
documents in ordinary way. On document saving the virus copies infected
template to the document’s folder and attaches this template to the
document. Next time this document is being opened, the infected template
will be automatically loaded by MS Word.

On first run on the computer the virus also creates in MS Word startup
folder the infected template Startup.dot. This template is automatically
activated when MS Word starts.

Also only on first run the virus drops on the A: drive, and executes a
Windows executable file that contains the “Back Orifice Trojan”
which is additionally infected with “Win95.Marburg” virus.
If there is no disk in drive A: MS Word can trap on incorrect operation.

The virus replaces standard ToolsMacros dialog box by its own empty one (stealth).