Virus.MSWord.Concept

Detect Date 01/11/2002
Class Virus
Platform MSWord
Description

Technical Details

This is the first WinWord virus found “in the wild”. The virus contains

five macros: AAAZAO, AAAZFS, AutoOpen, PayLoad, FileSaveAs. It infects the

files that are SaveAs’ed (FileSaveAs).

There are the text strings in the infected document:

see if we’re already installed

iWW6IInstance

AAAZFS

AAAZAO

That’s enough to prove my point

and other. The WINWORD6.INI on infected system contains the file:

WW6I= 1

On the first execution of the virus code (i.e. on the first opening of the

infected file) the MessageBox appears with digit “1” inside, and “Ok”

button.

Macro.Word.Concept.e

This virus contains four macros: Load, AAAZAO, AAAZFS, AutoOpen.

Macro.Word.Concept.f

This is an ancrypted virus. It contains seven macros: K, a678, PARA,

SITE, I8U9Y13, PayLoad, AutoOpen.

Macro.Word.Concept.ab

This virus contains three macros:

Documents NORMAL.DOT

MSConcept MSConcept

sAevaSeliF FileSaveAs

AutoOpen nepOotuA

It contains the comments:

Presenting The Microsoft Concept Virus.

Updated by Pyro [VBB] (Author of Word97.NightShade)

Macro.Word.Concept.s

This is Japanese version of standard “Concept”, it contains the same set of

macros: AAAZAO, AAAZFS, AutoOpen, PayLoad.