Kaspersky Threats

Class

Platform

Description

Technical Details

This encrypted macro virus, it contains three macros in documents and five
in NORMAL.DOT. The names in NORMAL.DOT depend on local Word version, in
case of Portuguese version the virus sets the second variant:



Documents    NORMAL.DOT

AutoOpen     AutoOpen

WinUpdate    WinUpdate,  FileSaveAs or FicheiroGuardarComo

WordSystem   WordSystem, FileSave   or FicheiroGuardar

The virus infects the global macros area on opening an infected document
(AutoOpen). It writes itself to documents that are saved (FileSave) and
saved with new name (FileSaveAs). On each opening an infected document the
virus increases its counter (that is saved in WINWORD6.INI file). When that
counter reaches 100, the virus erased the C:COMMAND.COM file.

Class	Virus
Platform	MSWord
Description	Technical Details This encrypted macro virus, it contains three macros in documents and five in NORMAL.DOT. The names in NORMAL.DOT depend on local Word version, in case of Portuguese version the virus sets the second variant: Documents NORMAL.DOT AutoOpen AutoOpen WinUpdate WinUpdate, FileSaveAs or FicheiroGuardarComo WordSystem WordSystem, FileSave or FicheiroGuardar The virus infects the global macros area on opening an infected document (AutoOpen). It writes itself to documents that are saved (FileSave) and saved with new name (FileSaveAs). On each opening an infected document the virus increases its counter (that is saved in WINWORD6.INI file). When that counter reaches 100, the virus erased the C:COMMAND.COM file.

Virus.MSWord.Razer

Technical Details