Macro.Word.Apparition
Description Macro.Word.Apparition
This is quite a primitive virus. It is dropped by Windows EXE virus "Win.Apparition". It contains three macros: WWUpdated, AutoOp (AutoOpen), FileOpen.
WWUpdated is the virus ID-macro. The virus detects its presence in the system by using this name. Macro AutoOp (AutoOpen in NORMAL.DOT) installs the virus macros into the system on opening an infected file. Macro FileOpen infects files on opening.
The virus contains the text strings, but does not use them in any way:
Presence of AVP for winword
AVP for Winword is a nice tutorial
(C) 2 Rats Soft.
this macro loaded in normal template as FileOpen
AVPcopyright$ AVP for WinWord v1.0
sQuestion$ Would you like to
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Sunbeam
Description Macro.Word.Sunbeam
This Word macro virus contains three macros: DocClose, SUNBEAM, FileOpen. The virus infects the global macros area (NORMAL.DOT) on closing an active window (DocClose) and writes itself to documents that are opened (FileOpen).
On October 5th the virus creates and executes the random named file (<3 letters of current document name>DIE.BAT) that contains the text:
echo 123>clock$
Macro.Word.Supers
Description Macro.Word.Supers
It is an encrypted macro virus. It contains one macro AutoOpen and infects system and documents on opening. On Friday 13th it writes to the C:AUTOEXEC.BAT file the commands:
@ECHO OFF
CLS
ECHO Friday the 13th sends greetings to everyone who's reading this text.
|