Macro.Word97.Desecration
Description Macro.Word97.Desecration
This is Chinese (Taiwan) specific macro virus contains five macros in one module "Desecration": AutoOpen, FileSave, FileNew, FileOpen, Desecration.
The virus infects the global macros area on opening an infected document (AutoOpen). Other documents get infection on their open, creating and saving (FileOpen, FileNew, FileSave).
The virus does not manifest itself in any way. The code of virus contains the comment:
Desecration By RUiNER /Sign Of Scream
Check other viruses! Be aware! Use Antiviral Software
Macro.PPoint.Kelly
Description Macro.PPoint.Kelly
This macro virus infects the MS PowerPoint presentations. The virus contains one macro "Jd" in the "Kelly" module. The virus code is activated on the MouseOver events on the infected form, it then runs its main routine and infects all form in opened presentations. While infecting the virus copies its code to the victim form and sets handler for MouseOver event to its own procedure. As a result the virus code runs automatically when mouse moves over infected form.
This virus does not have payload procedure. The code of virus contains the comment:
Copyright (C) 1998 by FlyShadow ~^^~ - Kelly
Macro.PPoint.ShapeMaster
Description Macro.PPoint.ShapeMaster
This macro virus infects the MS PowerPoint presentations. The virus contains one macro "actionhook" in the "ShapeMaster" module. The virus is activated on the MouseClick on the infected form, it then runs its installation routine and infects the PowerPoint installed on the computer. The virus then infects other presentations only when they are created.
While affecting the system the virus copies its code to the "Blank Presentation.pot" file in the Templates directory. This file is used as base while creating a new presentation. As a result the virus code is automatically copied to newly created presentations.
Depending on the system random counter the virus shows the previous slide of the infected presentation. Also depending on the random counter the virus displays the MessageBox:
PPT.ShapeMaster v0.1 /1nternal
|