Virus.MSWord.Reflex

Class Virus
Platform MSWord
Description

Technical Details


It is an encrypted virus. It contains three macros, but in any infected
document or global macros area two of them are identical.


NORMAL.DOT Infected files
Macro1 FA FA
AutoOpen
Macro2 FClose FClose
FileClose

The virus uses these duplicated macros as source macros while infecting –
to infect global macros area (on AutoOpen) the virus copies its macros:

FA -> FA
FClose -> FClose and FileClose

While infecting a document (on FileClose) the virus copies:

FA -> FA and AutoOpen
FClose -> FClose

The virus displays the message box with the text:

RED DWARF
Where’s the Gerbil of bubbly?