Kaspersky Threats

Class

Platform

Description

Technical Details

It is an encrypted virus. It contains three macros, but in any infected
document or global macros area two of them are identical.



NORMAL.DOT     Infected files

Macro1  FA             FA

AutoOpen

Macro2  FClose         FClose

FileClose

The virus uses these duplicated macros as source macros while infecting –
to infect global macros area (on AutoOpen) the virus copies its macros:



FA     -> FA

FClose -> FClose and FileClose

While infecting a document (on FileClose) the virus copies:



FA     -> FA and AutoOpen

FClose -> FClose

The virus displays the message box with the text:



RED DWARF

Where’s the Gerbil of bubbly?

Find out the statistics of the threats spreading in your region

Class	Virus
Platform	MSWord
Description	Technical Details It is an encrypted virus. It contains three macros, but in any infected document or global macros area two of them are identical. NORMAL.DOT Infected files Macro1 FA FA AutoOpen Macro2 FClose FClose FileClose The virus uses these duplicated macros as source macros while infecting – to infect global macros area (on AutoOpen) the virus copies its macros: FA -> FA FClose -> FClose and FileClose While infecting a document (on FileClose) the virus copies: FA -> FA and AutoOpen FClose -> FClose The virus displays the message box with the text: RED DWARF Where’s the Gerbil of bubbly?
	Find out the statistics of the threats spreading in your region