| Description:
|
Details
Macro.Word.Ultras.Joke
These viruses infect the Word documents. The infection is run on documents opening or closing.
The virus sets to "Ultras/Joke/ULTRAS2.usa.net" the Name/Initials/Address in document's UserInfo fields. The virus also makes changes in the Registry:
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersion]
"RegisteredOwner"="ULTRAS"
"RegisteredOrganization"="Rioters"
"ProductName"="JoKe By ULTRaS"
[HKEY_CLASSES_ROOTWORD.DOCUMENT.6DefaultIcon]
C:WindowsSystemShell32.dll,31
[HKEY_CLASSES_ROOTWord.TemplateDefaultIcon]
C:WindowsSystemShell32.dll,32 |
