| Description:
|
Details
Macro.Word.Incarnate
This is the Word macro virus. It contains seven macros: AutoExec, AutoExit, FileSave, AutoClose, FileClose, FileSaveAs, ToolsMacro.
The virus infects the global macros area (NORMAL.DOT) on closing an infected document (AutoClose, FileClose) and writes itself to documents that are saved (FileSave) or saved with new name (FileSaveAs). The virus contains a bug and while infecting by FileClose copies the same macros FileSaveAs to new macros FileSave and FileSaveAs. As a result the virus discloses itself on saving a document - instead of saving Word displays the FileSaveAs dialog box.
While closing a document the virus also appends the its end the text:
To end with, I would like to sayall
To defy me is to bring upon my wrath...
For I am CyberDarkness
I am Darkness Incarnate...
I will Not be Denied!!!
CyberDarkness
On leaving Word the virus writes new Desktop color set to the WIN.INI file. |
