Class Virus
Platform MSWord

Technical Details

This encrypted Word macro virus contains nine macros:

AutoExec – does nothing
autoOpen – infects current document or global macros area
FileClose – -//-
FileExit – -//-
FileSave – -//-
FileOpen – -//-
FileTemplates – -//-
ToolsMacro – -//-, disables Tools/Macro menu (stealth)
ShareTheFun – trigger routine

It infects the system and documents on opening, closing and accessing
Tools/Macro menu. It manifests itself in very unusual way – it sends
infected documents via MicrosoftMail, if it is installed.

On opening a document or template (AutoOpen) the virus with probability 1/4
calls the ShareTheFun macro. This macro saves the current (already
infected) document to the C:DOC1.DOC file, activates Microsoft Mail by
WordBasic instruction AppActivate, gets three random selected addresses
from addresses list and sends them the infected C:DOC1.DOC file with the
subject line:

You have GOT to read this!

If Microsoft Mail is not included in the running tasks, the virus shuts
down Windows.

Find out the statistics of the threats spreading in your region