Virus.MSWord.Sidor

Class Virus
Platform MSWord
Description

Technical Details


This macro virus contains five macro in documents: AutoOpen, FileClose,
FileTemplate, mir, ToolsMacro (stealth). In NORMAL.DOT It contains seven
macros: AutoExec, ToolsMacro, FileTemplate, FileSave, FileSaveAs, fucker,
sokker.


The virus infects the global macros area on opening an infected document
and copies itself to other documents on saving or saving with new name.
While infecting the virus uses anti-heuristic trick: it creates four
temporary macros, writes infection routines to there, executes these macros
and then deletes them.


The virus contains the comments:


Write by Sidorov Konstantin Matveevich, 73 years old, der. Vioshki,
Moscowskaya obl.
Sorry me, old grandfather, for some errors