Virus.MSWord.Want

Class Virus
Platform MSWord
Description

Technical Details


This is Chinese Word macro virus. It contains 5 macros: AutoOpen, dom,
free, ToolsMacro, want. The virus replicates itself on opening documents.


Starting from 15th of any month, in case of an error in macros the virus
writes to the C:AUTOEXEC.BAT file the command that will format the hard
drive:


FORMAT C:/S/U/V:VFS>NUL

The virus also creates the files OUT.COM, DOM.COM, KOS.COM that are
infected by viruses “Ph33r”, “Hare.7786”, “Natas.4746” and copies these
files with the names C:MSAV.COM, C:KILL.COM, C:GMOUSE.COM. The virus
also inserts calls to these files into the C:AUTOEXEC.BAT file.