macro.word.anti-iv
Webroot Antivirus: The best protection against viruses, spyware data theft and hackers.
Description:
Details
Macro.Word.Anti-IVX
It is not a dangerous semi-polymorphic macro virus. In infected documents it contains one macro AutoOpen that infects global macros area while opening an infected document. In infected NORMAL.DOT in contains two macros. The first macro is a copy of AutoOpen macro and has a random selected name. The second macro has the name FileSaveAs and infects documents that are saved with new name.
The virus is semi-polymorphic - while copying its AutoOpen macro it renames its internal values to other names, generates random name for copy of AutoOpen macro. While creating FileSaveAs macro the virus inserts commands that are selected from several variants and inserts random selected comments.
While infecting global macros area the virus creates the IVX.NOT file in the directory of the host file and writes the text to there:
IVX detects all macro viruses, past, present, and future.
It adds the command to the C:\AUTOEXEC.BAT file that clears the Read-Only attribute of NORMAL.DOT file:
@ATTRIB -R WordDirectory\NORMAL.DOT > NUL"
Copyright @2006 macro.word.anti-iv