|
|
Macro.Word.Tenface Viruses Information
| Name: |
Macro.Word.Tenface |
| Category: |
Viruses |
| Description:
|
Details
Macro.Word.Tenfaces
This is an encrypted macro virus. It contains three original macros, but while infecting it copies it with 8 different names to global macros area and with 4 names to documents. While copying the virus selects random name to hide its macros:
Documents NORMAL.DOT
Macro1: AutoOpen xxxxxLove
xxxxxLove
Macro2: xxxxxAnik xxxxxAnik
FileClose
Macro3: xxxxx1109 xxxxx1109
ToolsMacro
Organizer
ToolsCustomize
FileTemplates
where "xxxxx" are random strings.
The virus infects the system on AutoOpen call and writes itself to files on AutoClose. Macro3 is a payload macro and it disables Tools/Macro, Tools/Customize and File/Templates menus as well as Organizer. On these calls the virus displays the MessageBox:
Microsoft Word
You try to Kill meallhah!, I beat your Keyboard!
It then changes the keyboard layout.
The virus also creates new variables in system profiles (WIN.INI file) in [Intl] section:
Code_Name=WORDMACRO.TENFACES
Creator=Creator of NoMercy!
Dedicated=My Love, Anik AY |
Top Viruses Visited Pages:
Invader. - 239 visits
not-a-virus:RiskWare.Tool.RegPatch. - 72 visits
Worm.P2P.Harex. - 66 visits
not-a-virus:RemoteAdmin.Win32.RAdmin.2 - 60 visits
Small.58. - 56 visits
Coito.64 - 54 visits
I-Worm.Mapson. - 48 visits
Win16.Klon.1177 - 42 visits
Win32.Hidra - 42 visits
Marine.500 - 35 visits
Random Viruses Pages:
SatanBug.
Backdoor.Padodor.
Int1
Inch Famil
ITS.153
Net-Worm.Win32.Mytob.c
Zombie.PM.459
Alfa.307
Raving.230
I-Worm.Sysno
|
|
