Fandom

Malware Wiki

Psd

1,328pages on
this wiki
Add New Page
Comments0 Share

Virus.MSWord.Psd is a Virus that runs on the Microsoft Word program.

DetailsEdit

Psd is the first known macro virus infecting Office 2000 Word documents. It was discovered in December 1998. The virus uses the same methods of infection as Word/Word 97 viruses use. The only difference is that the virus is converted into the new Word document format and uses few Office 2000 specific instructions.

The virus affects the global macro area when an infected document is opened. The virus spreads itself into other documents when they are closed.

The virus disables Word anti-virus protection in two ways: by using Basic instruction and by writing to corresponding files in the system registry.

This is a stealth virus. While infecting the system it creates a stealth-macro that disables virus code viewing and exits Word without saving changes.

The virus also uses a polymorphic routine that randomly renames virus variable's and subroutine's names.

The virus code is places in one module in the Document_Open macro in infected documents. When an infected document is opened, the auto-macro Document_Open is executed by Word, then the virus code takes control and installs the virus into the system. During that the virus copies its code to the global macros area with the Document_Close name and creates additional stealth-macro ViewVBCode.

The virus checks the system date and time and if the current day number is equal to current minutes, the virus runs its trigger routine: it displays several figures of random size and random color.

The virus code contains the comment:

W97M/PSD by ALT-F11, VAMP Poly by VicodinES

Converted to W2000/PSD by VicodinES

VideosEdit

Virus.MSWord01:24

Virus.MSWord.Psd

Virus.MSWord.Psd by Alles

Psd MSWord Macro Virus01:27

Psd MSWord Macro Virus

Psd Macro Virus: By Tom KTW

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.