| Description:
|
Details
Macro.Word97.Unseen
This is a very dangerous polymorphic macro-virus. It contains one macro Document_Open and infects documents and global macros area on document opening. Depending on the system time and random counter, the virus corrupts the first two sectors on the C: drive.
The virus has quite an unusual stealth routine. When a document is opened, the virus moves its code from the macro area to the documents' variables, and replaces its code with a short macro program Document_Close that moves the virus code back to the macro area from the document's variables when the document is closed. As a result, the virus is invisible by using Word tools - when Word opens a document, the virus hides itself in the variables. When a document is closed, the virus restores its code, and the document on the disk stays infected. |
