| Description:
|
Details
Macro.Word97.Nail.a
This macro virus spreads its copies through the E-mail. While replicating it sends opened (infected) document to everyone in the user's address book. It also sends a message to somebody at "chainnail@hotmail.com" that contains all addresses from user's address book and random selected message from the Inbox.
While infecting the virus does not copy its code into documents or templates, but writes to victim files reference to AUTO.DOT template (attached template, see "Macro.Word97.ATU". When Word opens such document, it looks for attached templates, and loads them. The virus' template AUTO.DOT is stored on a hacker's Internet Web site, and as a result the virus author can "upgrade" the main virus code at any time.
The virus code contains the comments:
Automated Chain Mail v0.1 |
