Virus.MSWord.Reformasi

Class Virus
Platform MSWord
Description

Technical Details

This is a stelth macro-virus. It infects the global macros area (NORMAL.DOT
template) on infected document opening. Other documents get infected on
their opening, closing and saving. While infecting a document, the virus
adds the AutoCorrect entry to the document that replaces the text “yond” with
a space character.

Before saving victim documents, the virus sets up hidden property for a whole
text in a document and clears this property on document opening. As a result,
in desinfected documents, the whole text will be invisible. One way to solve
this problem is to check “View/Formatting marks/Hidden text [v]” checkbox
in “Tools/Options” dialog box. Another way to make the text visible is do
a commands click menu “Edit/Select All”, then in “Format/Font…” dialog
box uncheck “Effects/Hidden [ ]” checkbox.

To hide itself, the virus disables the keys Alt+F11 and Alt+F8, blocks opening
Visual Basic Editor, and ToolsMacro and Organaizer dialogue boxes.

The virus displays a non-standard dialogue on click “Help/About Microsoft Word”

Other two dialogs virus displays on choosing “File/Exit” menu if the day of the week is Friday.