This is an encrypted macro virus. It contains three original macros, but
while infecting it copies it with 8 different names to global macros area
and with 4 names to documents. While copying the virus selects random name
to hide its macros:
Macro1: AutoOpen xxxxxLove
Macro2: xxxxxAnik xxxxxAnik
Macro3: xxxxx1109 xxxxx1109
where “xxxxx” are random strings.
The virus infects the system on AutoOpen call and writes itself to files on
AutoClose. Macro3 is a payload macro and it disables Tools/Macro,
Tools/Customize and File/Templates menus as well as Organizer. On these
calls the virus displays the MessageBox:
You try to Kill me…hah!, I beat your Keyboard!
It then changes the keyboard layout.
The virus also creates new variables in system profiles (WIN.INI file) in
Creator=Creator of NoMercy!
Dedicated=My Love, Anik AY