Name: Macro.Word.Agen Category: Viruses Description: Details Macro.Word.Agent This is a polymorphic and stealth Word macro virus. It contains one macro "AutoOpen" and replicates on opening documents . The virus deletes the following menu items: Tools/Macro, Tools/Customize, File/Templates, Format/Style. The mutation (polymorphic) engine, depending on the random counter, inserts random comments into random positions into the virus code and renames some virus variables with random selected name. This engine is "slow" because it is executed only if, on infection, the current seconds are 23 or 45 only. As a result, in 97% of cases the polymorphic engine will not be executed and the "child" infector will have the same code as "parent" one. Depending on the random counter the virus sends a copy of current document to Internet news-groups, so to spread itself the virus uses global networks. It also can be a reason of confident information disclosing, if it is a part of document that is sent to Internet. To post documents to Internet the virus executed the news client AGENT.EXE, selects one of the news-groups (see the list below) and sends a message to there. The message has one of several possible Subjects (see the list below), the text "WM/Agent by Lord Natas" continued with random selected characters and attached infected document. The list of news-groups looks like follows: alt.aol-sucks alt.sex.zoophilia alt.binaries.cracks alt.windows95 alt.binaries.pictures.erotica alt.sex.passwords alt.binaries.warez.ibm-pc alt.binaries.warez alt.conspiracy alt.binaries.sounds.mp3 alt.drugs.pot alt.comp.virus alt.fan.hanson alt.2600 alt.flame alt.2600.hackerz alt.hacker alt.skinheads alt.sex alt.sex.babies alt.sex.necrophilia alt.sex.bondage alt.sex.stories Subjects are: Free XXX Passwords New Virus Alert! Check this out! Serial Number List! Official WaReZ site list Official mp3 site list Easy Money! Elite XXX site list My first fuck by Todd New erotic story Hanson rulez! Important Princess Diana Info Warez mailing list details Important Monica Lewinsky Info Crackz mailing list details How to find child pornography Learn to hack! Cable TV descrambler instructions! Attn: All k3wl h4ck3rz Kewl N64 Emulator & MP3 sites Important Info