Virus.MSWord.TenFaces

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted macro virus. It contains three original macros, but
while infecting it copies it with 8 different names to global macros area
and with 4 names to documents. While copying the virus selects random name
to hide its macros:


Documents NORMAL.DOT
Macro1: AutoOpen xxxxxLove
xxxxxLove
Macro2: xxxxxAnik xxxxxAnik
FileClose
Macro3: xxxxx1109 xxxxx1109
ToolsMacro
Organizer
ToolsCustomize
FileTemplates

where “xxxxx” are random strings.


The virus infects the system on AutoOpen call and writes itself to files on
AutoClose. Macro3 is a payload macro and it disables Tools/Macro,
Tools/Customize and File/Templates menus as well as Organizer. On these
calls the virus displays the MessageBox:


Microsoft Word
You try to Kill me…hah!, I beat your Keyboard!

It then changes the keyboard layout.


The virus also creates new variables in system profiles (WIN.INI file) in
[Intl] section:


Code_Name=WORDMACRO.TENFACES
Creator=Creator of NoMercy!
Dedicated=My Love, Anik AY