| Description:
|
Details
Macro.Word97.Mamm
This stealth macro virus contains one empty module "MAMM" and eighteen procedures in module "aviro": AstMaster, Mhapus, Mcopy, Action, FileOpen, AutoOpen, ViewVbCode, AutoExec, AutoExit, ToolsMacro, FileTemplates, FormatStyle, Refresh, AutoClose, FileExit, ToolsOptions, WBT, WBF.
It infects the global macros area on opening an infected document. The virus also creates in MS Word startup folder two infected files:
MAMM.dot
MAMM.src
On each document opening the virus checks all already opened documents and infects them. It also infects documents on their closing.
Starting from 15 May 1998 the virus activates its payload procedure. It sets its call on time 45 minutes after document opening. Payload procedure only displays the message box:
To: MAMM
If you delete this, you have no heart
The virus hooks menus "ToolsMacroMacrosall" and "ToolsMacroVisual Basic Editor". On click of these menus the virus displays "Record Macro" dialog box with macro description:
'If you delete this, you have no heart' |
