| Description:
|
Details
Macro.Word.Lunar
This is an encrypted macro virus. It contains seven macros: autoexec, autoopen, filesave, autoclose, filesaveas, toolsmacro, filetemplates.
The virus infects the global macros area on opening (AutoOpen) or closing (AutoClose) an infected document. It infects the documents that are saved (FileSave) or saved with new name (FileSaveAs).
The virus creates the LUNAR.INI file and writes the text to there:
[virus]
lunar=
author=Hyperlock
This is a stealth-virus - it hooks File/Templates and Tools/Macro, on entering these menus the virus displays the MessageBox:
Microsoft Word
Not enough memory to perform this operation
The virus contains the commented text strings:
WM.Lunar virus
AutoExec macro |
