| Description:
|
Details
Macro.Word97.Reformasi
This is a stelth macro-virus. It infects the global macros area (NORMAL.DOT template) on infected document opening. Other documents get infected on their opening, closing and saving. While infecting a document, the virus adds the AutoCorrect entry to the document that replaces the text "yond" with a space character.
Before saving victim documents, the virus sets up hidden property for a whole text in a document and clears this property on document opening. As a result, in desinfected documents, the whole text will be invisible. One way to solve this problem is to check "View/Formatting marks/Hidden text [v]" checkbox in "Tools/Options" dialog box. Another way to make the text visible is do a commands click menu "Edit/Select All", then in "Format/Fontall" dialog box uncheck "Effects/Hidden [ ]" checkbox.
To hide itself, the virus disables the keys Alt+F11 and Alt+F8, blocks opening Visual Basic Editor, and ToolsMacro and Organaizer dialogue boxes.
The virus displays a non-standard dialogue on click "Help/About Microsoft Word"
Other two dialogs virus displays on choosing "File/Exit" menu if the day of the week is Friday. |
