Virus.MSWord.Concept

Technical Details

This is the first WinWord virus found “in the wild”. The virus contains

five macros: AAAZAO, AAAZFS, AutoOpen, PayLoad, FileSaveAs. It infects the

files that are SaveAs’ed (FileSaveAs).

There are the text strings in the infected document:

see if we’re already installed
iWW6IInstance
AAAZFS
AAAZAO
That’s enough to prove my point

and other. The WINWORD6.INI on infected system contains the file:

WW6I= 1

On the first execution of the virus code (i.e. on the first opening of the

infected file) the MessageBox appears with digit “1” inside, and “Ok”

button.

Macro.Word.Concept.e

This virus contains four macros: Load, AAAZAO, AAAZFS, AutoOpen.

Macro.Word.Concept.f

This is an ancrypted virus. It contains seven macros: K, a678, PARA,

SITE, I8U9Y13, PayLoad, AutoOpen.

Macro.Word.Concept.ab

This virus contains three macros:

Documents   NORMAL.DOT
MSConcept   MSConcept
sAevaSeliF  FileSaveAs
AutoOpen    nepOotuA

It contains the comments:

Presenting The Microsoft Concept Virus.
Updated by Pyro [VBB] (Author of Word97.NightShade)

Macro.Word.Concept.s

This is Japanese version of standard “Concept”, it contains the same set of

macros: AAAZAO, AAAZFS, AutoOpen, PayLoad.