Technical Details
This is an encrypted Word macro virus. It contains one macro AutoOpen and
replicates itself when documents are opened. Only the files get infection
that are listed in the recently used file list, i.e. the virus does not
copy itself to global macros area.
The virus’ actual code is placed in document’s variable, and AutoOpen macro
gets that code from variables, creates new macro HONOR, inserts code into
it, executes and then deletes. The HONOR macro looks for documents in file
list and infects them.
The virus contains the comments:
After FutureNot, AntiFWIN, SlovakDictator and the NB Virii’s
comes now my contribution against the av-scanners.
HERE IS >>>>> HONOR <<<<<
|