| Description:
|
Details
Macro.Word.ShareFun
This encrypted Word macro virus contains nine macros:
AutoExec - does nothing
autoOpen - infects current document or global macros area
FileClose - -//-
FileExit - -//-
FileSave - -//-
FileOpen - -//-
FileTemplates - -//-
ToolsMacro - -//-, disables Tools/Macro menu (stealth)
ShareTheFun - trigger routine
It infects the system and documents on opening, closing and accessing Tools/Macro menu. It manifests itself in very unusual way - it sends infected documents via MicrosoftMail, if it is installed.
On opening a document or template (AutoOpen) the virus with probability 1/4 calls the ShareTheFun macro. This macro saves the current (already infected) document to the C:DOC1.DOC file, activates Microsoft Mail by WordBasic instruction AppActivate, gets three random selected addresses from addresses list and sends them the infected C:DOC1.DOC file with the subject line:
You have GOT to read this!
If Microsoft Mail is not included in the running tasks, the virus shuts down Windows. |
