These viruses contain four macros: Atom, AutoOpen, FileOpen, FileSaveAs,
and infects Word while loading an infected document (AutoOpen).
The viruses infect files in two ways: while opening a file (command
File/Open, macro FileOpen), and while saving a document with new name
(command File/SaveAs, macro FileSaveAs).
While infecting a document while saving it with new name (FileSaveAs) the
virus checks the system time. If the value of seconds is equal to 13 the
virus set the password ATOM#1 for this document. The virus cannot set the
password if the file is already infected – Word displays the WordBasic
While opening an infected document on 13th of December the virus deletes
all files in the current directory. It seems that the system has to display
the error message while deleting opened files.
“Atom.a”-related macro viruses differ from “Atom.a” only by placing their
WordBasic text strings in virus source code. “Atom.g” is “Atom.a”,
translated to German – it contains macros: Atom, AutoOpen, DateiÖffnen,