Class Virus
Platform MSWord

Technical Details

This is a German-specific Word macro virus. It contains eleven macros:
InnLib, FileOpen, FileSave, HilfeInfo, Innocence(AutoOpen), FileSaveAs,
ToolsMacro, DateiOffnen, DateiSpeichern, DateiSpeichernUnter, ExtrasMakro.

All infection routines are placed in InnLib macro, all other macros call
InnLib for necessary routines.

On opening a document the virus checks it for the macro viruses:

Atom Boom:De Buero:De Cap:De Clock:De Colors Concept Darkside Friday:De
Gangsterz Hot Imposter Lazy NF NomVir:De Friends:De Nuclear Nop:De Pheew
Spooky:De Stryx Target Tele Wazzu Zero:De Xenixos:De Outlaw

If any virus is found, the “Inlay” virus displays the MessageBox:

Innocence meldet:
Die Datei enth lt einen Makrovirus .
Identifiziert als:
Innocence wird nun versuchen, diesen Virus zu entfernen.
Ihr Dokument wird nicht besch digt.

The “Inlay” virus calculates the number of detected viruses in the WIN.INI
file in the section “[Intl]” in string “Killed”. In string ” “Inlay” it
keeps the month of latest infection. The virus also creates the INLAY file
which adds to the NORMAL.DOT and registers in the “pfad” string.

On entering the Tools/Macro menu the virus saves “backup” of the current
document to the NORMAL.DOC, removes all its macros and loads original not
infected file

Find out the statistics of the threats spreading in your region