Virus.MSWord.Sparkle

Class Virus
Platform MSWord
Description

Technical Details


This is a stealth macro-virus. It contains three modules and 11 functions:


“Sparkle” – FileSave, Toolsmacro, Filetemplates, Sparkle,
Toolsmacro, Filetemplates, ViewVbCode,
“userform999” – ListBox2_Click, UserForm_Initialize, CommandButton2_Click,
CommandButton5_Click, UserForm_Click,
“userform900” – CommandButton1_Click, CommandButton2_Click,
CommandButton3_Click, CommandButton4_Click,
CommandButton5_Click, CommandButton6_Click, ListBox2_Click,
ScrollBar1_Change, UserForm_Click.

On saving files (FileSave), the virus disables the VirusProtection, infects
the global macros area and documents.


The virus draws its own dialogue on entering the Tools/Macro menu (stealth).
On pressing any button (except “Cancel”), the virus displays the MessageBox:


Microsoft Word
This program has performed an illegal operation and will shut down.