This is the first WinWord virus found “in the wild”. The virus contains
five macros: AAAZAO, AAAZFS, AutoOpen, PayLoad, FileSaveAs. It infects the
files that are SaveAs’ed (FileSaveAs).
There are the text strings in the infected document:
and other. The WINWORD6.INI on infected system contains the file:
On the first execution of the virus code (i.e. on the first opening of the
infected file) the MessageBox appears with digit “1” inside, and “Ok”
This virus contains four macros: Load, AAAZAO, AAAZFS, AutoOpen.
This is an ancrypted virus. It contains seven macros: K, a678, PARA,
SITE, I8U9Y13, PayLoad, AutoOpen.
This virus contains three macros:
It contains the comments:
This is Japanese version of standard “Concept”, it contains the same set of
macros: AAAZAO, AAAZFS, AutoOpen, PayLoad.