Subscribe0 0
This is an encrypted macro virus. It contains three original macros, but while infecting it copies it with 8 different names to global macros area and with 4 names to documents. While copying the virus selects random name to hide its macros:
Documents NORMAL.DOT Macro1: AutoOpen xxxxxLove xxxxxLove Macro2: xxxxxAnik xxxxxAnik FileClose Macro3: xxxxx1109 xxxxx1109 ToolsMacro Organizer ToolsCustomize FileTemplateswhere "xxxxx" are random strings.
The virus infects the system on AutoOpen call and writes itself to files on AutoClose. Macro3 is a payload macro and it disables Tools/Macro, Tools/Customize and File/Templates menus as well as Organizer. On these calls the virus displays the MessageBox:
Microsoft Word You try to Kill me...hah!, I beat your Keyboard!It then changes the keyboard layout.
The virus also creates new variables in system profiles (WIN.INI file) in [Intl] section:
Code_Name=WORDMACRO.TENFACES Creator=Creator of NoMercy! Dedicated=My Love, Anik AY
Hot Articles