Macro.Word.Lordsatan
Description Macro.Word.Lordsatan
This is an encrypted macro virus. It contains two macros: AutoOpen, FileOpen. It infects the global macro area on opening an infected document (AutoOpen) and writes itself to other documents also on opening (FileOpen).
It creates a new section [Compatibility] in the WINWORD6.INI file and writes the string "MSWORD number" to there, where "number" is the virus generation. When "number" reaches 500, the virus displays the MessageBox " 500".
The virus contains the text "LordSatan" in its comments.
Check other viruses! Be aware! Use Antiviral Software
Macro.Word.Tenfaces
Description Macro.Word.Tenfaces
This is an encrypted macro virus. It contains three original macros, but while infecting it copies it with 8 different names to global macros area and with 4 names to documents. While copying the virus selects random name to hide its macros:
Documents NORMAL.DOT
Macro1: AutoOpen xxxxxLove
xxxxxLove
Macro2: xxxxxAnik xxxxxAnik
FileClose
Macro3: xxxxx1109 xxxxx1109
ToolsMacro
Organizer
ToolsCustomize
FileTemplates
where "xxxxx" are random strings.
The virus infects the system on AutoOpen call and writes itself to files on AutoClose. Macro3 is a payload macro and it disables Tools/Macro, Tools/Customize and File/Templates menus as well as Organizer. On these calls the virus displays the MessageBox:
Microsoft Word
You try to Kill meallhah!, I beat your Keyboard!
It then changes the keyboard layout.
The virus also creates new variables in system profiles (WIN.INI file) in [Intl] section:
Code_Name=WORDMACRO.TENFACES
Creator=Creator of NoMercy!
Dedicated=My Love, Anik AY
Macro.Word.Testarea
Description Macro.Word.Testarea
This macro virus contains only one macro AutoClose and replicates on closing a document. While infecting the virus saves the "backup" copy of document to the O:COMPSERVTESTAREA directory and saves the "report" information to the LOG.VRS file in the same directory: <UserName> <DocName> <DocPath> <DocName.VDC infection number> <date and time>
The virus also contains the text:
all.................Smile, I'm watching you...................
:)
|