Class Virus
Platform MSWord

Technical Details

This is an encrypted German-specific macro virus. It contains three macros:

Documents NORMAL.DOT
AutoOpen NOPO
NOPS DateiSpeichern
NOPSA DateiSpeichernUnter

It infects the global macros area on opening an infected document
(AutoOpen) and copies itself to documents that are saved (DateiSpeichern,
DateiSpeichernUnter – FileSave, FileSaveAs).

Depending on the system date and time the virus sets a password for current
document or/and exits Windows. On Friday13th it sets the password

Find out the statistics of the threats spreading in your region