| Description:
|
Details
Macro.Word.FunFun
This Word macro virus contains three macros with random selected names. To access these macros the virus writes their names to the WIN.INI file in section [Intl] in strings Info1, Info2, Info3 (in case of infected system - NORMAL.DOT) or in internal document's variables VirName, VirNameDoc, VirNamePayload (in case of infected document).
To force Word to run its macros the virus assigns them to a random selected key, i.e. the virus takes control only when that key is pressed.
There are several modifications of this virus. They display the MessageBoxes:
"Funfun.a": funfunfun
"Funfun.b": DARKTREMOR
Dark Tremor
Polytest Virus ist Aktiv !!!
"Funfun.b" also drops multipartite virus "Smile". |
