| Description:
|
Details
Macro.Word.Color (Rainbow, Color Changer)
This is encrypted virus, it contains the macros:
macros, FileNew, AutoExec, AutoOpen, FileExit,
FileSave, AutoClose, FileSaveAs, ToolsMacro
This virus infects the files while creating of new document (FileNew) and while saving the document with new name (FileSaveAs).
On each 300th call to the file functions (FileNew, AutoOpen, FileExit, FileSave, AutoClose, FileSaveAs and ToolsMacro) the virus alters the section [colors] in the WIN.INI file, and sets the random selected colors for Windows components. New colors appear after next Windows loading. The virus keeps the trigger counter in the WIN.INI file in the [windows] section:
[windows]
countersu= 234
The virus allows executing of Auto-macros (AutoOpen, AutoClose and so on), it sets DisableAutoMacros to zero.
When the virus is active, it is impossible to activate Tools/Macro command. To manual disinfection it is necessary to delete virus' macros by using Organizer (Tools/Customize, Word command, then draw Organizer out to toolbar). |
