| Description:
|
Details
Macro.Word97.Dreams.a
This virus contains five functions in one module "Dream": AutoOpen, FileOpen, FileNew, FilePrint, FileExit. The virus replicates itself on any function activating, i.e. on documents opening, creating or printing. To copy its code the virus uses export/import functions via the temporary C:CONFI~1.~YS file.
On Word exiting the virus depending on the system random counter saves the current document with one of the names: HARDCORE.DOC, HEROINKILLS.DOC, LESBIANS.DOC, DESIRE.DOC, GRAVITYKILLS.DOC, R.I.P-TALON.DOC, HOPE.DOC. Depending on the system date it saves it either on the M: drive (before 15th of month) or on the F: drive (starting from 15th).
The virus erases the menu items "Tools/Macro" and "Tools/Templates and add-insall". On 21st of any month it creates the C:WINDOWSDREAMS.TXT file and writes the text to there:
.-=BadDReAms=-.
When you sleep
Do you see an angel in the dying light
Or can you see someone standing outside
Trying to set you alight.
Maybe you`ve seen Someone Somewhere before
That I might have loved had I never loved you
But you only see Me In bad dreams |
