Virus.MSWord.NPad

Technical Details

It is an encrypted virus. It contains only one macro AutoOpen and infects

the global area / documents on opening an infected file / document.

The virus creates the profile section (WIN.INI file):

[NPad328]
Compatibility=

and saves its counter in there. On any infection the virus increases that

counter. When the counter reaches 23, the virus moves the string at the

status bar line:

D0EUNPAD94,  v.2.21,  (c)  Maret  1996,  Bandung,  Indonesia

The virus also has commented strings:

D0EUNPAD94, v.2.21, (c) Maret 1996, Bandung, Indonesia
Macro MsWord virus, multiplatform, multi versi