| Description:
|
Details
Macro.Word.Inlay
This is a German-specific Word macro virus. It contains eleven macros: InnLib, FileOpen, FileSave, HilfeInfo, Innocence(AutoOpen), FileSaveAs, ToolsMacro, DateiOffnen, DateiSpeichern, DateiSpeichernUnter, ExtrasMakro.
All infection routines are placed in InnLib macro, all other macros call InnLib for necessary routines.
On opening a document the virus checks it for the macro viruses:
Atom Boom:De Buero:De Cap:De Clock:De Colors Concept Darkside Friday:De
Gangsterz Hot Imposter Lazy NF NomVir:De Friends:De Nuclear Nop:De Pheew
Spooky:De Stryx Target Tele Wazzu Zero:De Xenixos:De Outlaw
If any virus is found, the "Inlay" virus displays the MessageBox:
Innocence meldet:
Die Datei enth lt einen Makrovirus .
Identifiziert als:
KEINE PANIK:
Innocence wird nun versuchen, diesen Virus zu entfernen.
Ihr Dokument wird nicht besch digt.
The "Inlay" virus calculates the number of detected viruses in the WIN.INI file in the section "[Intl]" in string "Killed". In string " "Inlay" it keeps the month of latest infection. The virus also creates the INLAY file which adds to the NORMAL.DOT and registers in the "pfad" string.
On entering the Tools/Macro menu the virus saves "backup" of the current document to the NORMAL.DOC, removes all its macros and loads original not infected file |
