Virus.MSWord.Uglykid

Class Virus
Platform MSWord
Description

Technical Details


This is a polymorphic Word macro virus. It contains one macro in documents:
AutoOpen, and two macros in NORMAL.DOT: FileSave, ToolsMacro. The virus
infects the global macros area (NORMAL.DOT) on opening an infected document
(AutoOpen) and writes itself to documents that are saved (FileSave).


The virus uses quite complex polymorphic engine – different infected files
have variable sets of commands in virus’ macros. The virus also uses quite
complex way to hide its main code in documents and templates: the main
virus code is placed in AutoText area and virus’ macros just read it from
there, copy the text to macros area and execute it. This is the first known
virus that uses such way to hide itself.


The virus sets the user’s name to “Nasty”. The polymorphic engine has bugs,
as a result it may produce corrupted code.