Macro.Word97.Badmacro
Details
Macro.Word97.Badmacro.a
This virus contains two macros AutoOpen and AutoClose, and replicates upon document opening or closing. Upon closing a document, starting from the 23rd of any month, the virus creates and executes the “C:\QSTART.COM” Trojan file clearing the CMOS memory. The virus has Russian origin: on the 1st and 13th of any month, it replaces, in the current document, the Russian words “here” with “there”. The virus also sets the description attributes for its macros:
AutoOpen: Absolutely bad macro (in Russian)
AutoClose: Reread Version 1.2!
Related Posts