|
Macro.Word.WallPape Viruses Information
| Name: |
Macro.Word.WallPape |
| Category: |
Viruses |
| Description:
|
Details
Macro.Word.WallPaper
This is an encrypted macro virus. It contains two original macros, but while infecting global macros area the AutoOpen macro is copied to four macros:
Documents NORMAL.DOT
FilePrint -> FilePrint
autoOpen -> autoOpen
ToolsMacro
FileTemplates
ToolsCustomize
The virus infects the documents on all calls that are listed above (opening or printing a file, entering menus File/Templates, Tools/Macro, Tools/Customize) and copies itself to global macros on opening an infected document.
The virus drops the SK2.BMP file that contains an image of a death's head.
On the 31th of any month the virus modifies the profile section [Desktop] (the WIN.INI file):
[Desktop]
Wallpaper=SK2.BMP
TileWallPaper=1
SK2=
and increases SK2 value on each infection. It also creates the C:WINDOWSREGSK2.REG and writes the text to there:
REGEDIT4
[HKEY_CURRENT_USERControl PanelDesktop]
"TileWallpaper"="1"
"Wallpaper"="C:\WINDOWS\SK2.BMP"
The virus then appends the following commands to the C:AUTOEXEC.BAT file :
@echo off
c:
cd c:windows
copy /y SK2.BMP c:windowssk2.bmp >nul
regedit regsk2.reg >nul
On the same date (31th) the virus, depending on the system time, displays the dialog:
[!!!PIRATE VIRUS!!!]-- Active!
The [PIRATE VIRUS] has pillaged your computer!
GO BACK TO MS-WORD?? |
Top Viruses Visited Pages:
Invader. - 231 visits
not-a-virus:RiskWare.Tool.RegPatch. - 69 visits
Worm.P2P.Harex. - 63 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 55 visits
Small.58. - 55 visits
Coito.64 - 53 visits
I-Worm.Mapson. - 45 visits
Win32.Hidra - 41 visits
Win16.Klon.1177 - 40 visits
Marine.500 - 34 visits
Random Viruses Pages:
AVCS.270.
DAME.Trigge
V.155
Macro.Word97.Alle
Macro.Word97.Redte
Se
7son.25
Ilja.170
PingPong.
DiskFille
|
