|
|
Macro.Word97.DasWo Viruses Information
| Name: |
Macro.Word97.DasWo |
| Category: |
Viruses |
| Description:
|
Details
Macro.Word97.DasWoo
This a stealth and polymorphic macro virus. It contains two modules ThisDocument and VC. The first module contains auto-function that is named AutoOpen in infected documents and AutoClose in infected NORMAL.DOT.
So the virus infects other documents on closing and affects the system on opening an infected document.
While infecting the auto-function calls the UserForm_Click function that is placed in the second virus module VC. The infection is performed by export/import virus modules to the temporary C:ONE.SYS and C:TWO.SYS files. The virus then modifies its code, so it is different in NORMAL.DOT and infected documents. For instance, the virus inserts into NORMAL.DOT two more functions to support its stealth ability: ViewVBCode and ToolsMacro. The virus also inserts into the document comments that contains the name of user, current time and path to active printer.
On July 28 the virus displays a window with the text:
|
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 72 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win16.Klon.1177 - 42 visits
Win32.Hidra - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
Sarov.140
Blazer.100
Aiwedr.85
P2P-Worm.Win32.Darby.
Ahav.37
Macro.Word97.Vacuit
Macro.Word97.Skaar
Tony.33
Shadowbyte.63
Sidewinder.204
|
|
