Virus.MSWord.Nop

Detect Date 01/11/2002
Class Virus
Platform MSWord
Description

Technical Details


These are silly macro viruses containing two macros. While infecting the
system global area (on AutoOpen) or a document (on DateiSpeichern –
FileSave) the viruses copy their macros with other names:


NORMAL.DOT Infected files
Macro1 DateiSpeichern NOP
Macro2 NOP AutoOpen

“Nop.d” has other set of names: AutoOpen and FileSave.


The viruses are very short – summary length of their macros is:


“Nop.a” – 246 bytes
“Nop.b” – 250 bytes

“Nop.a” has no destruction or trigger routines. “Nop.b” on FileSaveAs
inserts the text “Testvirus” into current document. “Nop.e” searches for
the text “. SAP” in the current document and replaces it with “. SÅP”.