Virus.MSWord.Percent

Class Virus
Platform MSWord
Description

Technical Details


This is a Chinese encrypted Word macro virus. It contains four macros:
Joke, AutoExec, AutoOpen, ToolsMacro.


On opening a document (AutoOpen) the virus creates the temporary “Back”
macro, fills it with its infection routine that reads from document’s
AutoText, executes (infects the NORMAL.DOT) and deletes. The same for
document infection.


Depending on system random counter and day of week the virus displays the
message (but does not format the disk):


Formatting C: . . .
Formatting C: % completed…

The virus then displays the MessageBox:

Format C:Hard disk C: format complete.
You must reboot to take effect !

On pressing “Ok” the virus exits Windows.