Searching
..

Click anywhere to stop

Virus.MSWord.TenFaces

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted macro virus. It contains three original macros, but
while infecting it copies it with 8 different names to global macros area
and with 4 names to documents. While copying the virus selects random name
to hide its macros:


Documents NORMAL.DOT
Macro1: AutoOpen xxxxxLove
xxxxxLove
Macro2: xxxxxAnik xxxxxAnik
FileClose
Macro3: xxxxx1109 xxxxx1109
ToolsMacro
Organizer
ToolsCustomize
FileTemplates

where “xxxxx” are random strings.


The virus infects the system on AutoOpen call and writes itself to files on
AutoClose. Macro3 is a payload macro and it disables Tools/Macro,
Tools/Customize and File/Templates menus as well as Organizer. On these
calls the virus displays the MessageBox:


Microsoft Word
You try to Kill me…hah!, I beat your Keyboard!

It then changes the keyboard layout.


The virus also creates new variables in system profiles (WIN.INI file) in
[Intl] section:


Code_Name=WORDMACRO.TENFACES
Creator=Creator of NoMercy!
Dedicated=My Love, Anik AY

Find out the statistics of the threats spreading in your region