Macro.PPoint.Attach
Description Macro.PPoint.Attach
This is the first known macro virus infecting MS PowerPoint presentation files. As well as other viruses infecting MS Office applications this is written in Visual Basic for Applications (VBA) language, and for spreading it uses Basic instructions and MS PowerPoint features.
The virus contains one macro that has event-function "UserForm_Terminate", this function is activated each time when UserForm is closed. This is the main virus function and it contains the virus infection routine.
When activated the virus infection routine searches for *.PPT files in the "C:My Documents" directory and subdirectory tree, opens files and copies its macro code to there.
Because of PowerPoint internal structure the virus is able to get control only in case any UserForm exists in target file. The virus checks files for UserForm presence and infects only such presentation. Otherwise the virus skips files and leaves them not infected.
The virus does not manifest itself in any way. It contains the comments, the first line is also used by the virus as the identification text to prevent duplicate infection:
<!--1nternal-->
PPT.Attach v0.1 /1nternal
Check other viruses! Be aware! Use Antiviral Software
Fanatik.304
Description Fanatik.304
This is a harmless non-memory resident parasitic virus. It searches for COM files in a current directory, then writes itself to the end of the file. The virus contains the following text string:
In member to the Titanic, (c) 1998 by FaNaTiK
Fans.560
Description Fans.560
It's a memory resident harmless parasitic encrypted virus. It hooks INT 01, 21h. It disables the tracing mode by using INT 01. INT 21h is used for the file infection. The virus infects COM-files on their execution. It encrypts the virus body and writes it to the file end. The decryption routine is saved into the file beginning - so the virus consist of two parts: the decryption part (at the file beginning) and the main virus body (at the file end). This virus contains the internal text string: "COMEXE Fans Ver 0.01".
|