| Description:
|
Details
Macro.Word.Illiteral
This is an encrypted Word macro virus. It contains three macros in documents and four macros in NORMAL.DOT: AutoOpen, Nod(AutoClose), Tiberium(FileTemplates, ToolsMacro).
The virus infects the global macros area (NORMAL.DOT) on opening an infected document and writes itself to documents that are closed.
On Sundays as well as on entering the Tools/Macro menu the virus sets the password for documents that depends on the current time. The virus then displays the DialogBoxes:
Brotherhood of NOD
User error !!, replace User !!
Enter new user name here:
If User name not fill, your data will be delete !
Brotherhood of NOD
Okay
We need to restart Word First
Then the virus writes the text to the C:WINDOWSNOD.INI file:
/----------------------------------------------------------|Virus name: Brotherhood Of NOD |
|Origin : Indonesia, Yogyakarta |
|Author : Foxz NoMercy Members |
|URL : http://www.geocities.com/ResearchTriangle/3996 |
----------------------------------------------------------/
Dear ,all
You was distrub this virus! please dont doit again
Password For =
I'm fair !!, I let you know the password for
Your document. Peace!! and Unity!!
--><--><--><--><--><--><--><--><--><--><--><--><--><--><-- |
