| Description:
|
Details
Macro.Word.Razer
This encrypted macro virus, it contains three macros in documents and five in NORMAL.DOT. The names in NORMAL.DOT depend on local Word version, in case of Portuguese version the virus sets the second variant:
Documents NORMAL.DOT
AutoOpen AutoOpen
WinUpdate WinUpdate, FileSaveAs or FicheiroGuardarComo
WordSystem WordSystem, FileSave or FicheiroGuardar
The virus infects the global macros area on opening an infected document (AutoOpen). It writes itself to documents that are saved (FileSave) and saved with new name (FileSaveAs). On each opening an infected document the virus increases its counter (that is saved in WINWORD6.INI file). When that counter reaches 100, the virus erased the C:COMMAND.COM file. |
