MDMA virus.
Information
about the MDMA virus:
This virus infects Word documents, templates and the NORMAL.DOT file
of Word 6 and Word for Windows 95. The virus code is contained in one macro
named "AutoClose". The virus code is encrypted. MDMA virus
has a dangerous payload.
When the first infected document is opened by Word the virus gets control
and it checks whether the Global Template file (NORMAL.DOT) is infected.
If it is not infected then the virus copies its macros to NORMAL.DOT and
there by infecting it. Then onwards the virus will be infecting all the
new document files created in that computer.
When an infected document is closed on the 1st day of any month MDMA
will display this message:
You are infected with MDMA_DMV.
Brought to you by MDMA (Many Delinquent Modern Anarchists)
The virus will activate its destructive code and the destriction done
will vary according to the operating system
In Windows 95 the virus will delete all the Control Panel (CPL) and
Help (HLP) files in the Windows directory. The virus will also make some
changes to the Windows Registry affecting the Logon, Display and Keyboard
settings.
In Windows NT the virus will delete all files in the current directory.
Under Windows 3.x the virus will add a line to the AUTOEXEC.BAT file
so that all files in the C drive will be deleted the next time the computer
is switched on.
MDMA virus first appeared in 1996 and it is in the wild.
Variants
of MDMA virus :
MDMA has several variants. They differ from the first virus in the message
box content and the date of activation.
Other
names of MDMA virus :
This worm is also known as WM/Mdma,
Word.Mdma, Stickykeys and SHMK.
Removing
MDMA virus from your computer:
You can remove this virus from your computer
by using Protector Plus antivirus software.
Click
here to download a 30 day Evaluation Copy of Protector Plus for your operating system
|