| Description:
|
Details
Macro.Word.Atom
These viruses contain four macros: Atom, AutoOpen, FileOpen, FileSaveAs, and infects Word while loading an infected document (AutoOpen).
The viruses infect files in two ways: while opening a file (command File/Open, macro FileOpen), and while saving a document with new name (command File/SaveAs, macro FileSaveAs).
While infecting a document while saving it with new name (FileSaveAs) the virus checks the system time. If the value of seconds is equal to 13 the virus set the password ATOM#1 for this document. The virus cannot set the password if the file is already infected - Word displays the WordBasic error message.
While opening an infected document on 13th of December the virus deletes all files in the current directory. It seems that the system has to display the error message while deleting opened files.
"Atom.a"-related macro viruses differ from "Atom.a" only by placing their WordBasic text strings in virus source code. "Atom.g" is "Atom.a", translated to German - it contains macros: Atom, AutoOpen, DateiÖffnen, DateiSpeichernUnter. |
