Virus.MSWord.Screw.a
| Alert Level : | High |
| Discovered: | Mar 07 2000 |
| Tag: | Macro Viruses |
| Discoverer and Source: | http://www.kaspersky.com/ |
Malware Behavior and Technical Description
This macro virus contains 11 macros:
Documents NORMAL.DOT ABC ABC AO AO AutoOpen FileOpen FileTemplates FP FP, FilePrint FSA FSA, FileSave, FileSaveAs HLP HELP, HLP SCR SCR TMC ToolsMacro, ToolsCustomize, FileTemplates, TMC ToolsMacroIt infects the global macros area on opening an infected document, but has an error - it copies nonexistent macros AE instead of AO. As a result this virus is able to replicate only once - there will be no AutoOpen macro in second generation.
On printing depending on the current time the virus pastes at the end of the document the text "SCREW VIRUS IS HERE" and replaces all sequences:
' a ' -> ' e ' ' I ' -> ' Me ' '. ' -> ' !!! 'and restores them after printing.
The virus installs new ScreenSaver (Marquee), this saver will display the message:
You Are Infected With The Screw Virus!!!
0
Removal Virus.MSWord.Screw.a instructions:
0
Need help? Live computer support via remote at SupportSpace |
