| Description:
|
Details
Macro.Word.KillProt
This is an encrypted macro virus. It contains four macros: AutoOpen, FileSaveAs, FileOpen, ToolsMacro. It infects global macros area on AutoOpen and ToolsMacro, documents get infection on FileOpen and FileSaveAs.
The virus creates the "Count=" parameter in "Infector" section in system profiles and increases its value on each FileSaveAs call. On every tenth saving a document with new name the virus sets the password for that document:
WhatTheHell
On any other saving the virus converts document to template. On each AutoOpen the virus deletes the macros AutoExit, InstVer, ShellOpen (ScanProt-specific macros). |
