| Description:
|
Details
Macro.Word.Emperor.a
This is a encrypted Chinese macro-virus that replicates itself only under the Chinese Word version.
This virus contains five macros: AutoOpen, Emperor, VirusMessage, FileTemplates, ToolsMacro (stealth). Upon opening an infected document (AutoOpen), the virus infects all current Word windows (i.e., all files that are edited). Upon entering the Tools/Macro menu, the virus erases all macros in NORMAL.DOT, and summons AutoOpen (infection routine).
Depending on the random counter and the day of week, the virus displays the following in the MessageBoxes (partly in Chinese):
The First Emperor Ver 1.00
The First Emperor Ver 1.00
SSCAN,GSCAN,MacroTrap |
