Macro.Word.Appder
Details
Macro.Word.Appder.a
This Word macro virus contains two original macros, but while infecting documents copies them to three macros:
NORMAL.DOT Infected files
Appder -> Appder, AutoOpen
AutoClose AutoClose
The virus infects the global macros area on AutoOpen and writes itself to documents on AutoClose. It also creates the “NTTHNTA=value” line in the “[Microsoft Word]” section in WINWORD6.INI file and increases this value while infecting any document. When this value reaches 20, the virus deletes the files:
C:\DOC\*.EXE
C:\DOC\*.COM
C:\WINDOWS\*.EXE
C:\WINDOWS\SYSTEM\*.TTF
C:\WINDOWS\SYSTEM\*.FOT
Related Posts