Virus.MSWord.Stealph

Class Virus
Platform MSWord
Description

Technical Details



This virus contains two macros:



Documents NORMAL.DOT



CSF FileOpen
AutoOpen CS


It replicates on documents opening. The documents->NORMAL.DOT infection
routine does not have replicating instructions in its code. Instead of
ordinary ways of infection, it creates the temporary CyberShadow macro,
fills it with instructions of replication that are stored in virus text
constants, executes and then deletes.


The virus contains the comments:



Stealth Wishes by CyberShadow…
Thanks to SGWW !