| Description:
|
Details
Macro.Word.Kilok.a
This is a family of Word macro viruses. They contain the macros:
"Kilok.a": AutoOpen
"Kilok.b": FileClose, NoMercy
In their macros the viruses do not have infection code "in clear" - the code there presents itself as encrypted text strings. To infect a document or NORMAL.DOT the viruses create a new macro, copy these strings to there, decrypt them and then execute. This new macro takes control and copies the code of original virus macro(s) to document or NORMAL.DOT.
"Kilok.b" contains the commented text:
--------------------------------------a Virus from NoMercy!!!
http://www.geocities.com/researchtriangle/3996
any critics, suggestions are welcome!
Yogyakarta, May/15/1997
-------------------------------------/
"Kilok.c,d" contains two macros in documents (AutoClose, NoMercy) and three macros in NORMAL.DOT (AutoClose, ToolsMacro, FileTemplate). These viruses contain the same text as "Kilok.b". |
