Virus Characteristics

This macro virus infects the MS PowerPoint presentations. The virus contains one macro "actionhook" in the "ShapeMaster" module. The virus is activated on the MouseClick on the infected form, it then runs its installation routine and infects the PowerPoint installed on the computer. The virus then infects other presentations only when they are created.

While affecting the system the virus copies its code to the "Blank Presentation.pot" file in the Templates directory. This file is used as base while creating a new presentation. As a result the virus code is automatically copied to newly created presentations.


Payload

Depending on the system random counter the virus shows the previous slide of the infected presentation. Also depending on the random counter the
virus displays the MessageBox:

PPT.ShapeMaster v0.1 /1nternal