| Description:
|
Details
Macro.Word.NF
It is an extremely silly encrypted virus containing nothing except infection routines. Summary length of its two macros (nf, autoclose) is just 286 bytes.
Both virus macros contains infection routines. First macro infects global area while closing an infected document (it is named "autoclose" in infected documents and "nf" in NORMAL.DOT), second macro infects documents that are closed (it is named "nf" in infected documents and "autoclose" in NORMAL.DOT). So the virus exchanges names of these macros as several macro viruses do - while infecting a file or global area it copies "nf" macro with name "autoclose", and "autoclose" with name "nf".
NORMAL.DOT Infected files
Macro1 nf autoclose
Macro1 autoclose nf
While infecting the system the virus displays the string "Infected!", while infecting a file the virus displays "Traced!". |
