Virus.MSWord.Remplace

Class Virus
Platform MSWord
Description

Technical Details



This macro virus contains seventeen macros in one module “Akrnl”: Akrnl,
AutoExec, AutoNew, AutoPrint, FileNew, FileClose, FileExit, autoOpen,
AutoExit, AutoClose, ToolsMacro, FileTemplates, ViewVBCode, RandomRemplace,
Remplace, Sauve, DelVir.


It infects the global macros area on opening an infected document
(AutoOpen) and infects other documents on opening, closing, printing or
creating (FileOpen, AutoPrint, FileClose, FileNew). Before infecting the
virus removes all modules from infecting document and global macros area.


The virus turns off the Word virus protection (the VirusProtection option).


On opening infected document if day of month is above 22, the virus with
probability about 27% replaces text “donc,” with one of following strings:



ainsi, si j’en crois ce que mon incomp�tant de professeur me dit,
ainsi, mon chat a perdu ses dents. De plus,
ainsi, selon ma grand-m�re,
ainsi, la mati�re du cours est plate. De plus,