| Comments: |
O97M.Crown-B is a triple infector
(Word, Excel and PowerPoint). When an infected document is
run in Word the Macro Virus Protection for the other applications
is turned off. However, the virus author has not yet worked
out how to disable the Protection from within Excel or Powerpoint,
a trivial piece of VBA programing. The actual replication
routines are trivial variants on the code in other macros.
|