Class Virus
Platform MSWord

Technical Details

This virus contains two macros: AutoOpen, Sveta. It replicates on opening
infected documents (AutoOpen): it searches for documents in FileList
(recently used files list) and infects them. So the virus is “nonmemory
resident” – it is active only when infected document is being opened, and
AutoOpen macro takes control. When it releases control, the virus does not
intercept any events and does not infect files (if, of course, NORMAL.DOT
or some another auto-loaded template is not listed in FileList).

On activating at 13 seconds (i.e. on opening an infected document) the
virus displays to the StatusBar the message:

———-======> SVETA by Kid Chaos [SLAM] <=======----------

Find out the statistics of the threats spreading in your region