Virus.MSWord.Wordde

Class Virus
Platform MSWord
Description

Technical Details


This is a dangerous Word macro virus. It contains six macros: WordDE,
AutoExec, FileOpen, FilePrint, FileSaveAs, AutoOpen (WordSU in NORMAL.DOT).
It infects the system on opening an infected document (AutoOpen), it
infects documents that are opened (FileOpen) and saved with new name
(FileSaveAs).


The virus sets on the system timer a macro that shutdowns Word in a random
selected time. On printing documents the virus replaces a string in Russian
with new one. The virus creates the section in Windows profile (WIN.INI
file):


[gay]
lox=

When counter reaches 5, the virus erases the COMMAND.COM file.