Virus.MSWord.Unseen

Technical Details

This is a very dangerous polymorphic macro-virus. It contains one macro
Document_Open and infects documents and global macros area on document
opening. Depending on the system time and random counter, the virus corrupts
the first two sectors on the C: drive.

The virus has quite an unusual stealth routine. When a document is opened, the
virus moves its code from the macro area to the documents’ variables, and
replaces its code with a short macro program Document_Close that moves the
virus code back to the macro area from the document’s variables when the document
is closed. As a result, the virus is invisible by using Word tools – when
Word opens a document, the virus hides itself in the variables. When
a document is closed, the virus restores its code, and the document on the disk
stays infected.