Subscribe0 0
This is an encrypted Word macro virus containing only one macro - LoneRaider. This is not an auto macro, and it can be executed only by user's request, i.e. if it is run by Tools/Macro/Run menu item.
When the virus takes control, it replicates itself. While replicating the virus does not use any macro copy commands, but creates and runs new macro named "LoneRaiderTwo" and uses this macro to copy itself to system global macros or a document.
To do that the virus calls the Tools/Macro/Edit menu item to edit new "LoneRaiderTwo" macro, inserts to there WordBasic commands including MakroKopieren (MacroCopy), then it runs this macro and deletes it by Tools/Macro/Run and Tools/Macro/Delete menu items. When executed, the "LoneRiderTwo" macro copies the original "LoneRaider" macro to the destination document or global macros area.
On January 1st the virus creates a new template and inserts the strings to there:
Enjoy the first F/WIN Killer! LoneRaider! Nightmare Joker 1996
Hot Articles