Macro.PPoint.ShapeShift
Description Macro.PPoint.ShapeShift
This is the second known macro virus infecting MS PowerPoint presentations. It contains five macros in one module "ShapeShift": actionhook, SlideIn, WackShape, RandomWackSlide, WackPresentation.
To activate its code on a event the virus hooks MouseClick that pass control to the virus "actionhook" macro. This macro runs the infection routine: the virus affects all active presentations, then searches for presentation files in the current directory and subdirectories and infects them.
Depending on the system random counter the virus changes the active slide number. Also depending on the random counter the virus displays the MessageBox:
PPT.ShapeShift v0.1 /1nternal
Check other viruses! Be aware! Use Antiviral Software
BAT.Zeke.324
Description BAT.Zeke.324
It is a harmless nonmemory resident companion virus named after its internal variable "zeke". It searches for EXE files, renames them to *.DSS and creates companion BAT files. DOS will load and execute batch virus instead of original EXE file.
BAT.ZekeZip
Description BAT.ZekeZip
This virus uses a way similar to BAT.Zeke.324, but compresses infected EXE files with PKZIP and password "zeke".
|