Macro.Word97.Shar
Details
Macro.Word97.Shark
This macro virus contains nine procedures in module “Switch”: AutoOpen, AutoNew, AutoClose, AutoExec, AutoExit, FileSave, First, Second, Third.
It spreads on opening, closing, creating and saving documents. The virus turns off the virus protection and disables “Macro” and “Visual Basic” command bars. The infection procedure copies virus module into all opened templates and also into active document. Then it checks for file “C:\PROTECT.SYS”, and if it does not exist, the virus exchanges names of two document files in active document folder.
The virus body contains the comments:
>>> Switch - An Israeli Virus <<<
Written by
” The Israeli Shark ”
All Rights Reserved
1999(C)
Related Posts