Detect Date | 01/11/2002 |
Class | Virus |
Platform | MSWord |
Description |
Technical DetailsThis is the first WinWord virus found “in the wild”. The virus contains five macros: AAAZAO, AAAZFS, AutoOpen, PayLoad, FileSaveAs. It infects the files that are SaveAs’ed (FileSaveAs). There are the text strings in the infected document:
and other. The WINWORD6.INI on infected system contains the file:
On the first execution of the virus code (i.e. on the first opening of the infected file) the MessageBox appears with digit “1” inside, and “Ok” button. Macro.Word.Concept.eThis virus contains four macros: Load, AAAZAO, AAAZFS, AutoOpen. Macro.Word.Concept.fThis is an ancrypted virus. It contains seven macros: K, a678, PARA, SITE, I8U9Y13, PayLoad, AutoOpen. Macro.Word.Concept.abThis virus contains three macros:
It contains the comments:
Macro.Word.Concept.sThis is Japanese version of standard “Concept”, it contains the same set of macros: AAAZAO, AAAZFS, AutoOpen, PayLoad. |