home.gif (921 bytes)Virus

Up Level

Macro.Word.Sidor

This macro virus contains five macro in documents: AutoOpen, FileClose, FileTemplate, mir, ToolsMacro (stealth).

In NORMAL.DOT It contains seven macros: AutoExec, ToolsMacro, FileTemplate, FileSave, FileSaveAs, fucker, sokker.

The virus infects the global macros area on opening an infected document and copies itself to other documents on
saving or saving with new name. While infecting the virus uses anti-heuristic trick: it creates four temporary macros,
writes infection routines to there, executes these macros and then deletes them.

The virus contains the comments:
Write by Sidorov Konstantin Matveevich, 73 years old, der. Vioshki, Moscowskaya obl.
Sorry me, old grandfather, for some errors

 
  Back to my Front page 
1996-2008 Maxim V. Sidorov, All Rights Reserved