Virus.MSWord.Shark

Technical Details

This macro virus contains nine procedures in module “Switch”: AutoOpen,
AutoNew, AutoClose, AutoExec, AutoExit, FileSave, First, Second, Third.

It spreads on opening, closing, creating and saving documents. The virus
turns off the virus protection and disables “Macro” and “Visual Basic”
command bars. The infection procedure copies virus module into all opened
templates and also into active document. Then it checks for file
“C:PROTECT.SYS”, and if it does not exist, the virus exchanges names of
two document files in active document folder.

The virus body contains the comments:

>>> Switch – An Israeli Virus <<<
Written by
" The Israeli Shark "
All Rights Reserved
1999(C)