Class Virus
Platform MSWord

Technical Details

This encrypted Word macro virus contains nine macros:

AutoExec – does nothing
autoOpen – infects current document or global macros area
FileClose – -//-
FileExit – -//-
FileSave – -//-
FileOpen – -//-
FileTemplates – -//-
ToolsMacro – -//-, disables Tools/Macro menu (stealth)
ShareTheFun – trigger routine

It infects the system and documents on opening, closing and accessing
Tools/Macro menu. It manifests itself in very unusual way – it sends
infected documents via MicrosoftMail, if it is installed.

On opening a document or template (AutoOpen) the virus with probability 1/4
calls the ShareTheFun macro. This macro saves the current (already
infected) document to the C:DOC1.DOC file, activates Microsoft Mail by
WordBasic instruction AppActivate, gets three random selected addresses
from addresses list and sends them the infected C:DOC1.DOC file with the
subject line:

You have GOT to read this!

If Microsoft Mail is not included in the running tasks, the virus shuts
down Windows.