Virus.MSWord.Sveta

Class Virus
Platform MSWord
Description

Technical Details


This virus contains two macros: AutoOpen, Sveta. It replicates on opening
infected documents (AutoOpen): it searches for documents in FileList
(recently used files list) and infects them. So the virus is “nonmemory
resident” – it is active only when infected document is being opened, and
AutoOpen macro takes control. When it releases control, the virus does not
intercept any events and does not infect files (if, of course, NORMAL.DOT
or some another auto-loaded template is not listed in FileList).


On activating at 13 seconds (i.e. on opening an infected document) the
virus displays to the StatusBar the message:


———-======> SVETA by Kid Chaos [SLAM] <=======----------