Virus.MSWord.Razer

Class Virus
Platform MSWord
Description

Technical Details


This encrypted macro virus, it contains three macros in documents and five
in NORMAL.DOT. The names in NORMAL.DOT depend on local Word version, in
case of Portuguese version the virus sets the second variant:


Documents NORMAL.DOT
AutoOpen AutoOpen
WinUpdate WinUpdate, FileSaveAs or FicheiroGuardarComo
WordSystem WordSystem, FileSave or FicheiroGuardar

The virus infects the global macros area on opening an infected document
(AutoOpen). It writes itself to documents that are saved (FileSave) and
saved with new name (FileSaveAs). On each opening an infected document the
virus increases its counter (that is saved in WINWORD6.INI file). When that
counter reaches 100, the virus erased the C:COMMAND.COM file.