| This macro virus contains five macro in documents: AutoOpen, FileClose, FileTemplate, mir, ToolsMacro (stealth). In NORMAL.DOT It contains seven macros: AutoExec, ToolsMacro, FileTemplate, FileSave, FileSaveAs, fucker, sokker. The virus infects the global macros area on opening an infected document and copies itself to other documents on
saving or saving with new name. While infecting the virus uses anti-heuristic trick: it creates four temporary macros,
writes infection routines to there, executes these macros and then deletes them. The virus contains the comments:
Write by Sidorov Konstantin Matveevich, 73 years old, der. Vioshki, Moscowskaya obl.
Sorry me, old grandfather, for some errors |
Back to my Front page