|
|
Macro.Word.Nuke Viruses Information
| Name: |
Macro.Word.Nuke |
| Category: |
Viruses |
| Description:
|
Details
Macro.Word.Nuker
This is an encrypted Word macro virus. It contains 8 macros:
Documents NORMAL.DOT
AutoOpen AutoOpenNuke
AutoExecNuke AutoExec
FileOpenNuke FileOpen
FileSaveAsNuke FileSaveAs
FileTemplatesNuke FileTemplates
NukePower NuclearPower
ShellOpenNuke ShellOpen
ToolsMacroNuke ToolsMacro
The virus infects the global macros area (NORMAL.DOT) on opening an infected document (AutoOpen) and writes itself to documents that are also opened (FileOpen). On infecting the virus checks files for other macros and deletes them, if they are found. The virus checks the filenames for special symbols (spaces, semicolons,all). If there is such one, the virus truncates the file name and displays the MessageBox:
NuclearPower
You cannot open multiple files at the same time with NuclearPower
installed. The first file you selected will be opened.
On saving document with new name the virus displays the InputBox:
Save As
Please, enter the name of the file:
The AutoExec macros (on Word startup) assigns the NuclearPower with "Ctrl+Shift+O" keys. This macro being executed displays the MessageBox:
NuclearPower greets you
You are infected by NuclearPower.
But, I swear that I am harmless and
I will protect you from any other macro virus!
The virus also modifies the System Registry, as a result the virus macros are executed on DDE calls. |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 73 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win32.Hidra - 43 visits
Win16.Klon.1177 - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Priv.193
Shaker.37
Bomzh.380
Predator.113
Fire.268
Poopie.28
Radio.207
Saratov.179
Weed.408
Macro.Word.Mu
|
|
