Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically


This is a macro virus for the program Microsoft Word. It consists of 4 macros with names Bob, Alice, Colin and AutoOpen. Upon opening an infected document the virus finds out whether there is the macro Colin. If it is the virus supposes that the given installation of Word already is infected.
If it is not the virus copies the macros Colin, Bob and Alice into the global template NORMAL.DOT. At the same time it stores the macro Bob into the global template also under the name FileSaveAs.
After the global template NORMAL.DOT is infected the virus attacks opened documents as they are being saved. Then, with a chance of 10 %, it induces execution of the macro Colin. That macro is supposed to alter some of the data in the file FileSummaryInfo. It may change the author to "FC", name to "Smash Technology" and subject to "Resist Oppression". It may create key words and commentaries in a random way. Each of the alternations is independent on the others and has a chance of 50 %. Finally, with a chance of 20 %, the virus displays the following window with the text:

The macro Alice is not used at all.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.