Name: Macro.Word97.Akum Category: Viruses Description: Details Macro.Word97.Akuma It is a dangerous macro virus. It infects global macro area on opening an infected document. Other documents get infection also on their opening. The infection routine finds virus procedures separately and stores them into the disk file "C:CONT.DBL". When victim document is infecting the routine adds the code from this file to document without destroying document's macros, except "Document_Close" and "Document_Open" macros. It makes the virus more stealthy. In one case of two the virus changes document's summary information: Title = "Akuma Macro Carrier" Author = "Akuma" Keywords = "Mary Bitch" The virus sets recent edited files list size to maximum - nine files (every opened file MS Word adds in this list). On document closing the virus checks the system date and if the day is 16, 17 or 18 executes payload routine. This routine looking for file "C:MARY.LOG" that must have "hidden" and "read only" attributes set and if it doesn't found overwrites all files from recent files list. The virus replaces content of this files on text: Something wonderful has happened, your PC is alive and even better but some of your documents are infected by the Akuma virus. Mary is simply a bitch and you, , are a stupid jerk and lose some files. Have a nice day. After that the files are almost unrecoverable.