Virus.MSWord.ZMB

Class Virus
Platform MSWord
Description

Technical Details


This is a German Word macro virus. It contains four macros: AutoOpen
(NORMAL.DOT – ZMB), ExtrasMakro, DateiDrucken, DateiSpeichern.


The virus infects the global macros area (NORMAL.DOT) on opening an
infected document (AutoOpen) and writes itself to documents that are saved
(DateiSpeichern).


This is stealth virus: it replaces Extras/Makro (Tools/Macro) menu with
another one. Depending on the system random counter the virus replaces the
words while printing documents.


On March 31st it erases the CONFIG.SYS, AUTOEXEC.BAT files and displays the
MessageBox:


Osterhasenpolizei
Hallihallo….
Ich bin der Osterhase und sage Dir, dax man
an Ostern keinen Computer benutzen soll !!