| Description:
|
Details
Macro.Word97.Sparkle
This is a stealth macro-virus. It contains three modules and 11 functions:
"Sparkle" - FileSave, Toolsmacro, Filetemplates, Sparkle,
Toolsmacro, Filetemplates, ViewVbCode,
"userform999" - ListBox2_Click, UserForm_Initialize, CommandButton2_Click,
CommandButton5_Click, UserForm_Click,
"userform900" - CommandButton1_Click, CommandButton2_Click,
CommandButton3_Click, CommandButton4_Click,
CommandButton5_Click, CommandButton6_Click, ListBox2_Click,
ScrollBar1_Change, UserForm_Click.
On saving files (FileSave), the virus disables the VirusProtection, infects the global macros area and documents.
The virus draws its own dialogue on entering the Tools/Macro menu (stealth). On pressing any button (except "Cancel"), the virus displays the MessageBox:
Microsoft Word
This program has performed an illegal operation and will shut down. |
