Class Virus
Platform MSWord

Technical Details

This is Chinese Word macro virus. It contains 5 macros: AutoOpen, dom,
free, ToolsMacro, want. The virus replicates itself on opening documents.

Starting from 15th of any month, in case of an error in macros the virus
writes to the C:AUTOEXEC.BAT file the command that will format the hard


The virus also creates the files OUT.COM, DOM.COM, KOS.COM that are
infected by viruses “Ph33r”, “Hare.7786”, “Natas.4746” and copies these
files with the names C:MSAV.COM, C:KILL.COM, C:GMOUSE.COM. The virus
also inserts calls to these files into the C:AUTOEXEC.BAT file.

Find out the statistics of the threats spreading in your region