Name: Macro.Word.Ocho Category: Viruses Description: Details Macro.Word.Ochoy This is an encrypted macro virus containing five macros in infected documents and ten macros in global macros area (NORMAL.DOT): Documents NORMAL.DOT Ard01, AutoOpen Ard01 Ard02 Ard02, FileSave, AutoClose Ard03 Ard03, FileTemplates, ToolsMacro, ToolsCustomize Ard04 Ard04, FileOpen It infects the global macros area on opening an infected document (AutoOpen) and copies itself to documents that are saved or closed (FileSave, AutoClose). Before infecting the virus deletes all macros in target. The virus stores the counter of infections in document's variable "ard01". Depending on this counter the virus either prints to the status line the text "O C H O Y * P K T B N I", or displays the MessageBox: BNI - PKT (c) Ardi Sunardi - 1 9 9 7