Virus.MSWord.Vicissitator

Class Virus
Platform MSWord
Description

Technical Details


This is a polymorphic Word macro virus. It contains only one macro in
infected documents – FileSave, but while infecting the system it creates
two macros – FileSave and ToolsMacro (stealth). The virus replicates itself
when documents are saved (FileSave). While infecting the virus creates the
Vicissitator macro, copies its code to there and edits it (polymorphic
engine). The virus then copies to the document the result macro with name
FileSave.


While infecting NORMAL.DOT the virus writes the text to the ToolsMacro
macro:


You have been Infected by the Vicissitator Macro Virus.
(C)1997 CyberYoda A Member of the SLAM Virus Team