| Description:
|
Details
Macro.Word97.Psd
This is a Word97 macro-virus. It has stealth and polymorphic abilities. In infected documents, the virus has one auto-macro Document_Open and installs itself into the global macros area upon opening an infected document. While installing, the virus copies its macro with the Document_Close name and infects other documents on closing. The virus also creates, in the global macros, its stealth-macro ViewVBCode, which terminates Word on any attempt to view macro code.
The virus also disables Word anti-virus protection. On infecting, it randomly renames virus variables and subroutine names (polymorphism).
The virus checks the system date and time, and in case the current day number is equal to the current minutes, the virus runs its trigger routine: it displays several figures of random size and random color.
The virus versions contain the comments:
"Psd.a":
W97M/PSD allporn star dreams? [(c)1998 ALT-F11 code hack]
VAMP v1.0 [thanks Vic!]
"Psd.b":
W97M/PSD.II ...logically delicious! [(c)1998 ALT-F11 code hack]
VAMP v1.0 [thanks Vic!] |
