Class Virus
Platform MSWord

Technical Details

This is a stealth macro-virus. It contains three modules and 11 functions:

“Sparkle” – FileSave, Toolsmacro, Filetemplates, Sparkle,
Toolsmacro, Filetemplates, ViewVbCode,
“userform999” – ListBox2_Click, UserForm_Initialize, CommandButton2_Click,
CommandButton5_Click, UserForm_Click,
“userform900” – CommandButton1_Click, CommandButton2_Click,
CommandButton3_Click, CommandButton4_Click,
CommandButton5_Click, CommandButton6_Click, ListBox2_Click,
ScrollBar1_Change, UserForm_Click.

On saving files (FileSave), the virus disables the VirusProtection, infects
the global macros area and documents.

The virus draws its own dialogue on entering the Tools/Macro menu (stealth).
On pressing any button (except “Cancel”), the virus displays the MessageBox:

Microsoft Word
This program has performed an illegal operation and will shut down.

Find out the statistics of the threats spreading in your region