| Description:
|
Details
Macro.Word97.Smac
This is a polymorphic macro-virus. It infects the global macros area on opening an infected document, and spreads itself to documents that are closed. The virus was named after one of its internal variables - "Smac".
The virus has stealth abilities, and on entering the ViewVBCode menu, it displays the message:
Illegal function in module 0xCB15C00
The virus contains six macros in one module "cb4111": AutoOpen, AutoExec, ViewVBCode, Do_The_Thing, AutoExit. The virus also has the Morph function that is used in virus polymorphic engine.
While infecting the NORMAL.DOT (global macros area), the virus also creates the infection AutoClose macro in there.
The virus contains the comments:
ThE wEiRd GeNiUs is back!
Greetings to the Codebreakers, VicodinEs & Lord Natas and to ALT-F11
Thanks for the cb4111 guide.
Until the next bug, greetings, WG |
