Virus.MSWord.Theatre

Class Virus
Platform MSWord
Description

Technical Details


These are encrypted viruses, they contain the macros:


“Theatre.a”: ToolsMacro, DocClose, FileClose, AutoOpen, CK
“Theatre.b”: ToolsMacro, DocClose, FileClose, AutoOpen, CK, CK1

On 1st (“Theatre.a”) or on 15th (“Theatre.b”) of any month they delete all
files in C: disk root directory. The viruses display the dialog boxes:


“Theatre.a”:


TAIWAN THEATRE VIRUS by Dark Word
Hay..Hay.. YOU GOT A THEATRE VIRUS.

“Theatre.b”

THEATRE