Macro.Word.Ciao
Details
Macro.Word.Ciao.a
This German specific macro virus contains three macros in infected documents and two ones in NORMAL.DOT:
Documents NORMAL.DOT
———– ———–
DateiOffnen DateiOffnen - FileOpen
DateiSpeichernUnter DateiSpeichernUnter - FileSaveAs
AutoClose
The virus installs itself into the system when an infected document is closed. While installing the virus saves the current document the name C:\DATEI.DOC and copies its two macros (DateiOffnen and DateiSpeichernUnter) to the global macros area (NORMAL.DOT).
The virus infects other documents when they are saved with new names (FileSaveAs). To infect them the virus copies its three macros from the C:\DATEI.DOC file.
On file opening and saving with new name the virus displays the message:
Winword
Zu wenig Arbeitsspeicher!
Schlie#en Sie alle laufenden Anwendungen!
!! Es besteht die Gefahr von Datenverlusten !!
The virus also inserts into documents the text:
*** A new star is born ***
Related Posts