Virus.MSWord.ShareFun

0 0

This encrypted Word macro virus contains nine macros:

AutoExec      - does nothing
autoOpen      - infects current document or global macros area
FileClose     -  -//-
FileExit      -  -//-
FileSave      -  -//-
FileOpen      -  -//-
FileTemplates -  -//-
ToolsMacro    -  -//-, disables Tools/Macro menu (stealth)
ShareTheFun   - trigger routine

It infects the system and documents on opening, closing and accessing Tools/Macro menu. It manifests itself in very unusual way - it sends infected documents via MicrosoftMail, if it is installed.

On opening a document or template (AutoOpen) the virus with probability 1/4 calls the ShareTheFun macro. This macro saves the current (already infected) document to the C:\DOC1.DOC file, activates Microsoft Mail by WordBasic instruction AppActivate, gets three random selected addresses from addresses list and sends them the infected C:\DOC1.DOC file with the subject line:

You have GOT to read this!

If Microsoft Mail is not included in the running tasks, the virus shuts down Windows.