Class Virus
Platform MSWord

Technical Details

This is a dangerous macro virus. In infects documents and global macros
area (NORMAL.DOT). There are six virus macros, but there are only five
different ones:

Macro1 Puritan Puritan
Macro2 Rtr Retro
Macro3 FSAB FileSaveAs
Macro4 AOB AOB
Macro5 ToolsMacro ToolsMacro

The virus infects global macros area on AutoOpen and documents on
FileSaveAs. The virus deletes the anti-virus files, if they exist:

C:Program FilesNorton AntiVirusVirscan.Dat
C:Program FilesF-Prot95Fpwm32.dll
C:Program FilesMcAfeeScan.dat

It also appends to the end of AUTOEXEC.BAT file the commands that also
delete these files:

@echo off
IF exist C:Program FilesNorton AntiVirusVirscan.Dat
then del C:Program FilesNorton AntiVirusVirscan.Dat
IF exist C:Program FilesF-Prot95Fpwm32.dll
then del C:Program FilesF-Prot95Fpwm32.dll
IF exist C:Program FilesMcAfeeScan.dat
then del C:Program FilesMcAfeeScan.dat
IF exist C:Tbavw95Tbscan.sig
then del C:Tbavw95Tbscan.sig

On accessing Tools/Macro menu the virus displays the MessageBox with the

Out of memory.
WordBasic Err = 7

The virus contains the comments in the Puritan macro:

The Style of macro virii was invented by
those with an Open mind…
If you have an Open mind To other influences
you will grow out as one of the best…
‘Poet of the highest quality 😉 from
‘— Neophyte —-

Find out the statistics of the threats spreading in your region